* agent: Added `encrypt_verify_incoming` and `encrypt_verify_outgoing` options to use for upshifting to encrypted gossip on an existing cluster.
* agent: Added a method for gracefully transitioning to TLS on an existing cluster. [GH-1705]
* agent: Added a method for [transitioning to gossip encryption on an existing cluster](https://www.consul.io/docs/agent/encryption.html#configuring-gossip-encryption-on-an-existing-cluster). [GH-3079]
* agent: Added a method for [transitioning to TLS on an existing cluster](https://www.consul.io/docs/agent/encryption.html#configuring-tls-on-an-existing-cluster). [GH-1705]
* agent: Added support for RetryJoin on Azure [GH-2978]