Encrypting a PDF during Hazel processing
I would go with option #2. 

You can use command line tools to handle the encryption. A quick google search reveals a free, for non-commercial use, tool

http://community.coherentpdf.com/

which you can call using applescript like this:

do shell script "cpdf -encrypt AES \"pass\" \"\" in.pdf -o out.pdf"

This way there are no dialog boxes to enter a password. It will encrypt them with the same one if that is ok. Less secure but more convenient.

HTH