Hello, I'll be adding a better guideline on the encryption window as I can understand the confusion there.
You are correct, the GRF Encryption tool window is only meant to create the client files (client.exe + cps.dll). The "Encrypt GRF" option was removed from that window because it was redundant. To encrypt your GRF, you have to right-click a folder and select encrypt:
This does the same thing as the previously removed option. That is also how you're supposed to encrypt your Thor patches when you want to patch encrypted content.
As for the password prompt when opening the GRF, that is mostly for visual effect in the first place. An encrypted GRF may not have this prompt. Also, the GRFs can be partially encrypted, so if you choose "Cancel" when this prompt shows up, you can still browse the GRF depending on what you did.