slightly crafty steve, but I got it.

Interestingly, MS advise one of the first things you should do on installing an instance is backup the service master key, and this indeed you can do even though encryption has not been activated. So what in fact are we backing up at that point?