Clarify how to get encrypted properies to clients

Fixes gh-349

docs/src/main/asciidoc/spring-cloud-config.adoc

@@ -671,6 +671,17 @@ TIP: the `{name:value}` prefixes can also be added to plaintext posted
 to the `/encrypt` endpoint, if you want to let the Config Server
 handle all encryption as well as decryption.
 
+=== Serving Encrypted Properties
+
+Sometimes you want the clients to decrypt the configuration locally,
+instead of doing it in the server. In that case you can still have
+/encrypt and /decrypt endpoints (if you provide the `encrypt.*`
+configuration to locate a key), but you need to explicitly switch off
+the decryption of outgoing properties using
+`spring.cloud.config.server.encrypt.enabled=false`. If you don't care
+about the endpoints, then it should work if you configure neither the
+key nor the enabled flag.
+
 == Serving Plain Text
 
 Instead of using the `Environment` abstraction (or one of the