The checkpoint sk article isn't that helpful... what it should say is... If you have your encryption domain set as "defined by topology", then check your topology!