Updating system image (via add system image command) copies over the config from the current image with encrypted config.
There is no encryption enabled in the updated image, so enabling the same overwrites the key stored in the TPM. It causes encrypted config load to fail when switching to the previous system image:

Loading the previous image after enabling encryption in the latest image:

[  104.449960] vyos-router[874]: Mounting VyOS Config...done.
[  123.259602] vyos-router[1290]: No key available with this passphrase.
[  123.298193] vyos-router[874]: ERROR: Failed to decrypt config volume.

Loading the previous image after enabling and then disabling encryption in the latest image:

[  133.687194] vyos-router[874]: Mounting VyOS Config...done.
[  138.797179] vyos-router[874]: ERROR: Failed to fetch encryption key from TPM. Encrypted config volume has not been mounted

So the current behaviour is as described above, however it could be that updating system image should fully migrate the existing encryption but not just copying the config contents to the new image. In this case the problem would be that existing encryption is not migrated to the new image

Steps to reproduce:

1. Enable encryption
2. Update system image via add system image command
3. Enable encryption in the updated image
4. Load previous image