Your post reminded me I needed to finish up a workflow I had half way done. I'm not sure this is the best way of handling things but here is an action that was first designed to merge just the property groups on the component ( to mimic what happens in the gui ). I've added a couple of options. First option will merge in the blueprint level property groups and custom properties and the second option also evaluates the component level custom properties.
I'm not feeling super confident the way I am filtering out the custom properties is the correct way of doing things. I posted another question about that but I'm pretty sure what I am doing should isolate only those values.
Sounds like you got that correct... not sure on decrypting. We don't currently store anything encrypted. Maybe an api call from another service is needed?