add wrapper script to encrypt a string that we can use as secret pillar
    
    also add a file "encrypted_pillar_recipients" that lists all gpg
    recipients that the script will use