s3/cups: add encryption support