On the optimality of quantum encryption schemes