Which account should be used for the SQL Server Service logon account where the server has been added to a domain?
What I have seen implemented in a few enterprise size companies is to have an Active Directory  managed service account created on a per server or cluster basis which runs the database and agent services.

Depending on group policies in place you may have to also request that AD group policies or local security policies be modified to allow the right to "logon as a service".  There is no need to grant extra privileges to the account.  

Ideally you would add this account during the setup of a new install so the permissions on the SQL Server executables are granted automatically.

This benefits security policy as auditors can see that the password policy of the domain is applied to the account and that the account has privileges only on the server/cluster that are appropriate to run the database and nothing else.

I recommend a managed service account to do this because if you are at the stage where you are implementing encryption you might as well do all the right things from a security standpoint now so you don't have to go back and redo them later.  A well named dedicated account will allow you apply a complex password that can be changed as required by company standards without wondering about where else you used that account.