What does encrypt do and can we do on the fly encrypt on transfer to a bucket?

Yes. The config file is at ~/.rclone.config. You can drop that file on any system with Rclone installed and it will work.

Yep. You can use the remote as a source and something unecrypted as the destination and rclone crypt will decrypt it on the fly for you.