When using encryption without a TPM, the user should be prompted to confirm that the key they entered is correct. Mistyping a key is a common error. Forcing the user to type the same key twice will help mitigate user error and confirm they are using the right key to encrypt the config.