I love that idea! I think you could use the anonymous gist API. Have the tool output to stdout/pbcopy the gist URL that was created upon encrypt and similarly have it accept a gist URL to decrypt. Nothing to send on either side beyond the URL.