rework encrypt --add, fixes #44