The command could check that publishable is used and then, after data is downloaded, use the field to drop all non-publishable fields (as some kind of subcommand perhaps, or other mini command like iedeidentify although that's a bad command name). Could also potentially check that a key is included when encryption is desired.