Crypt filter with /Identity: passthrough unchanged