There does not appear to be a guide for enabling on-disk encryption for existing replica sets with existing data.

The documentation re encryption at rest mentions "Encrypting data with the database keys" as a third step in the process but it is not obvious what this would mean for an existing database. One could have imagined that we would automagically encrypt the data when the server is started.