If the NSA gets hold of your private key file, they will most likely get hold of your settings.ini file with the password, so there's no added value to passwording the file.

If you're referring to NSA's ability to "crack" a private key based on tapped communication, passwording a key won't help in such a case, because the key is always used unpassworded in the communication.

Adding a password capability would induce a corner cases that need to be solved - what to do if there's no password, or bad password is given, should the user be warned, the server aborted, or drop to HTTP-only mode?