diff --git a/generators/hooks/build/user.go b/generators/hooks/build/user.go
index 3739a9d4..c2e52296 100644
--- a/generators/hooks/build/user.go
+++ b/generators/hooks/build/user.go
@@ -20,7 +20,6 @@ import (
 
 // UserPayload returns a string for the user hook payload
 func UserPayload() string {
-
 	configModel, _ := models.LoadConfig()
 	payload := map[string]interface{}{
 		"provider": configModel.Provider,
@@ -102,7 +101,14 @@ func getKey(keyFile string) ([]byte, error) {
 	buf := block.Bytes
 
 	if encryptedBlock(block) {
-		if x509.IsEncryptedPEMBlock(block) && configModel.SshEncryptedKeys {
+		if x509.IsEncryptedPEMBlock(block) {
+			if configModel.NoEncryptedKeys {
+				return nil, fmt.Errorf("Skipping encrypted ssh key")
+			}
+
+			display.PauseTask()
+			defer display.ResumeTask()
+
 			// prompt for password to decrypt key
 			fmt.Printf("Password protected key found!\nPlease enter the password for '%s'\n", keyFile)
 			for attempts := 0; attempts < 3; attempts++ {
diff --git a/models/config.go b/models/config.go
index 06a5e0df..4e48ca54 100644
--- a/models/config.go
+++ b/models/config.go
@@ -24,8 +24,8 @@ type Config struct {
 	DockerMachineNetworkSpace string `json:"docker-machine-network-space"`
 	NativeNetworkSpace        string `json:"native-network-space"`
 
-	SshKey           string `json:"ssh-key"`
-	SshEncryptedKeys bool   `json:"ssh-encrypted-keys"`
+	SshKey          string `json:"ssh-key"`
+	NoEncryptedKeys bool   `json:"no-encrypted-keys"`
 
 	Anonymous bool `json:"anonymous"`
 	LockPort  int  `json:"lock-port"`
diff --git a/processors/configure_set.go b/processors/configure_set.go
index 0c935207..1f1fa192 100644
--- a/processors/configure_set.go
+++ b/processors/configure_set.go
@@ -30,8 +30,8 @@ func ConfigureSet(key, val string) error {
 		config.NativeNetworkSpace = val
 	case "ssh_key", "ssh-key":
 		config.SshKey = val
-	case "ssh_encrypted_keys", "ssh-encrypted-keys":
-		config.SshEncryptedKeys = val == "true" || val == "t" || val == "1"
+	case "no_encrypted_keys", "no-encrypted-keys":
+		config.NoEncryptedKeys = val == "true" || val == "t" || val == "1"
 	case "lock_port", "lock-port":
 		config.LockPort, _ = strconv.Atoi(val)
 	case "ci-mode", "ci_mode":
diff --git a/util/display/display.go b/util/display/display.go
index a5623d6b..0d9243a1 100644
--- a/util/display/display.go
+++ b/util/display/display.go
@@ -137,7 +137,7 @@ func StartTask(format string, args ...interface{}) error {
 	return nil
 }
 
-// PauseTask ...
+// PauseTask pauses the summarizer so you can print to stdout.
 func PauseTask() {
 	// stop the task summarizer
 	if Summary && summarizer != nil {
@@ -151,7 +151,11 @@ func PauseTask() {
 	}
 }
 
-// ResumeTask ...
+// todo: make a quiet pause/resume task. just disable the "summarizer" and don't
+// print junk on resume. maybe just delete the previous line `* Paused Task` so
+// it will be overwritten with the `⣷ Resumed Task` header.
+
+// ResumeTask resumes the summarizer, so output is swallowed unless `-v` is passed.
 func ResumeTask() {
 	// resume task
 	if Summary && summarizer != nil {