Yeah I think we can remove the TODO comment and keep it as is.  If the user specifies the arg, they want the password decrypted, and if we can't do that we should complain about it.