CentOS7

It has already been addressed in MDEV-8990, except for this:

According to the documentation it should be innodb-encrypt-tables = FORCE

Documentation does not say it should be FORCE. It can be ON (same as no argument). See config example on the same page.

The encryptions.preset file says it now, and in the future, guarantees that everything will be encrypted. I think it should be FORCE in this example.

If you mean the comment in the preset file, it now says, I'm quoting,

# !include this file into your my.cnf (or any of *.cnf files in /etc/my.cnf.d)

# and it will enable data at rest encryption. This is a simple way to

# ensure that everything that can be encrypted will be and your

# data will not leak unencrypted.

That's exactly what the value 'ON' does. The value 'FORCE' does not add anything to 'encrypting everything that can be encrypted', it only makes InnoDB produce errors when you are explicitly trying to create an unencrypted table. These tables are outside the scope of the comment because they cannot be encrypted anyway.
So, I consider ON to be a most reasonable value for preset.
However, I don't see it anyhow important to keep arguing. Assigning to serg to decide.

My bad, you are right about that. I remembered it not setting encryption by default somehow, but it does. I remembered wrong.

• loose- makes the preset usable when InnoDB is not loaded. For example, when a user only wants to use Aria or, may be, she is going to install InnoDB plugin run-time.
• aria-encrypt-tables — fixed, thanks
• FORCE already answered apove.