Don't leak the default parameters for kdf and cipher_mode when parsing arguments in main().
New options to specify the encryption cipher to use.

Currently, only the default aes256 (with the specified mode) is
supported, but this more or less prepares kc to extend this, later.