Yes, that's correct. The script takes the output from bw-cli and pipes it directly (sort of since we also store it in a variable to calculate the number of rows) to gpg which then encrypts it.
The only secret we have in plain text here is the API token for Todoist which I'm OK with. It's always the balance between security and comfort.
https://github.com/Granddave/aegis-rs