cli/show: use decryption policy "auto" by default.