agent: Support encrypt CLI flag. Fixes #245.