use spawn instead of exec when encrypting

It turns out, using child_process.spawn is probably safer in general and more likely to work correctly than child_process.exec, since you can specify the arguments directly, rather than having them be interpreted by the shell.