decrypt workflow: pipe compressed file directly into encryption and then taring (i.e. no intermediate files)

Also check the decrypt workflow for the same thing