It seems that return result of an auth proxy script is not enough to specify a non-standalone rclone backend. For example,
[encrypted]
type = crypt
remote = remote:/Encrypted
we need to have a config entry for the remote backend before we can create a crypt backend.