I think there should be some indication that the option labeled AES128 is the same as if you where selecting AES. This can help in cases when devices (like other m0n0wall derivatives) still label the option as "AES". Especially now since the DES and 3DES options are no longer possible on newer OPNSense releases.