But encrypting a wallet.dat creates 100 new keys in a keypool, so I'm not so sure it's a good plan to decrypt it for use, then encrypt it for storage. If you google things like encrypted wallets bitcointalk, you'll find people complaining about this. I could have sworn I read people dealing with wallets that had completely different addresses encrypted compared to decrypted.

Also, if you're going to use a wallet.dat for offline use, a wallet.dat from bitcoin-qt isn't a deterministic wallet, so once 100 addresses are used up, and they will be due to change, the offline won't be keeping up with the keys getting created online, or something like that. It's quite complicated, I still don't understand it myself.