These arguments to pg_upgrade help with upgrading encrypted clusters.
Option: --copy-by-block
Copies files to the new cluster block by block instead of the default, which is to copy the whole file at once. This option is the same as the default mode but slower. It does, however, support upgrades between clusters with different encryption settings.
You must use this option when upgrading between clusters with different encryption settings, that is, unencrypted to encrypted, encrypted to unencrypted, or both encrypted with different keys. While copying files to the new cluster, it decrypts them and reencrypts them with the keys and settings of the new cluster.
If the old cluster is encrypted and the new cluster was initialized as unencrypted, this option decrypts the data from the old cluster and copies it to the new cluster unencrypted. If the old cluster is unencrypted and the new cluster was initialized as encrypted, this option encrypts the data from the old cluster and places it into the new cluster encrypted.
See the description of the initdb --copy-key-from=<file> option for information on copying a key from an existing cluster when preparing a new cluster as a target for pg_upgrade.
Supported values
The --copy-by-block option doesn't require specifying any values.
See Adding encryption and upgrading with pg_upgrade or Migrating from PostgreSQL to Enterprise Postgres for --copy-by-block usage examples.
Option: --key-unwrap-command=<command>
Provides the command to unwrap (decrypt) the data encryption key and access the files to copy. It must be the same unwrap command you specified when initializing the cluster.
Supported values
<command> is customizable, but it must contain the placeholder %p, which specifies the file to read the wrapped key from. The command must write the unwrapped key to its standard output. Use the special value - if you don't want to apply any key unwrapping command. See Choosing a key protection mechanism for more information.
If you don't use this option, pg_upgrade falls back on the environment variable PGDATAKEYUNWRAPCMD.