How to create encrypted spice subcircuit/schematic and use it as symbol in other schematics?
The -encrypt command line switch is only valid for subcircuits, not schematics, or hierarchical schematics. As the manual says in Modes of Operation &gt; Command Line Switches:


  Encrypt a model library. For 3rdparties wishing to allow people to use libraries without revealing implementation details. Not used by Linear Technology Corporation models.


XVII.exe -encrypt /path/to/subcircuit.sub


The extension is really just for your convenience, LTspice will read the file and detect wether it's a schematic (.asc) or library (.sub, .lib, .net, .cir, etc). That is, LTspice will encrypt the file you provide, but when reading it must be of the subcircuit/netlist type.

Caveat emptor: the subcircuit will be deleted and replaced by the encrypted version! So if you still need your subcircuit to be avaliable to you, make a copy first, before encrypting.