Opening this again. I think this actually should be in Anaconda, because using --encrypted without --passphrase is a valid kickstart input:
"If no passphrase is specified, the default system-wide one is used, or the installer will stop and prompt if there is no default." https://github.com/vpodzime/pykickstart/blob/master-docs/docs/kickstart_docs...