As explained by michaelh in MDL-80490, as the group enrolment key is not a password and it's likely that a readable key is required, the setting 'Group enrolment key policy'(groupenrolmentkeypolicy) should be disabled by default on new sites.

This would make it consistent with the self enrolment key setting 'Use password policy' which is disabled by default.