Questions about command line encryption

When you invoke "keybase pgp encrypt" on your device, I assume it is using the primary, private PGP key stored on the web server. If so, how is that private key securely transmitted to the device (or do all of the devices keep a copy of the server's private PGP key as well as device-specific private keys)?

If you use the command-line "keybase encrypt" to prepare a file for another keybase user and email the encrypted file to them, and then they add another device to their keybase profile, will they be able to decrypt the file on that new device? I know the addition of new devices works seamlessly if you share the file through kbfs and allow the encryption and decryption to be handled implicitly by kbfs; I'm curious if this still works when encrypting and decrypting from the command line.

The issue names the `keybase pgp encrypt` and `keybase encrypt` command-line entry points but provides no files or tests. Start by locating the documentation or implementation for those commands and trace their device and key handling. Done means clearly documenting whether newly added devices can decrypt files and how private keys are handled.

Written by the indexing model from the issue text.