pw: add option to use private key encryption