set up the gpgcli environment locally, which an app-local GNUPGHOME

don't use the gpgcli aliases
clarify readme
pass Context through to the encrypt tasks
define GNUPGHOME inside our app's private dir