'aws cloudformation package' does not respect bucket's default encryption setting

When running aws cloudformation package without any --kms-key-id arguments, the cli actually adds AES256 as a default in the S3Uploader. This is not desired, the S3Uploader should leave the default up to the default encryption set for the bucket.
This results in files being uploaded with AES256 server-side encryption set, instead of the actual default server-side encryption set for the bucket. Not everybody has the permission to perform get-bucket-encryption, so the kms key id can not always be known.

Offending code:

https://github.com/aws/aws-cli/blob/77de650dd40cec644d7a962e08ee4ec5a2187b8d/awscli/customizations/s3uploader.py#L99-L103