re-work secrepo config

Change so secrepo config without args simply provides status.
Add --activate --encrypt --decrypt