I think it might be worth to clarify, in the Wiki, under https://github.com/netinvent/npbackup/wiki/Security,-permissions-and-keys#aes-encryption-keys , that the environment variables NPBACKUP_KEY_LOCATION or NPBACKUP_KEY_COMMAND must be given before running NPBackup; in particular, it does not work if we specify them in "Environment variables" in the GUI.
(This might be obvious to many people, but it tripped me a couple of times).