Merge pull request #4332 from ClickHouse/JeremyChen-tde-disable-note

Clarify TDE cannot be disabled once enabled

Author: Blargian

docs/cloud/security/cmek.md

@@ -19,7 +19,7 @@ Enhanced encryption is currently available in AWS and GCP services. Azure is com
 
 ## Transparent Data Encryption (TDE) {#transparent-data-encryption-tde}
 
-TDE must be enabled on service creation. Existing services cannot be encrypted after creation.
+TDE must be enabled on service creation. Existing services cannot be encrypted after creation. Once TDE is enabled, it cannot be disabled. All data in the service will remain encrypted. If you want to disable TDE after it has been enabled, you must create a new service and migrate your data there.
 
 1. Select `Create new service`
 2. Name the service