If windows is encrypted with keys from the TPM anyways, then tailscale doesn't need to encrypt a second time.

Windows also bit me in the ass with this feature, but tailscale not enabling encryption wouldn't have helped one iota.