Encap/decap in pkeyutl - documentation

doc/man1/openssl-pkeyutl.pod.in

@@ -13,6 +13,7 @@ B<openssl> B<pkeyutl>
 [B<-rawin>]
 [B<-digest> I<algorithm>]
 [B<-out> I<file>]
+[B<-secret> I<file>]
 [B<-sigfile> I<file>]
 [B<-inkey> I<filename>|I<uri>]
 [B<-keyform> B<DER>|B<PEM>|B<P12>|B<ENGINE>]
@@ -28,6 +29,8 @@ B<openssl> B<pkeyutl>
 [B<-encrypt>]
 [B<-decrypt>]
 [B<-derive>]
+[B<-encap>]
+[B<-decap>]
 [B<-kdf> I<algorithm>]
 [B<-kdflen> I<length>]
 [B<-pkeyopt> I<opt>:I<value>]
@@ -79,6 +82,11 @@ then the B<-rawin> option must be also specified.
 Specifies the output filename to write to or standard output by
 default.
 
+=item B<-secret> I<filename>
+
+Specifies the output filename to write the secret to when the operation is
+either I<-encap> or I<-decap>.
+
 =item B<-sigfile> I<file>
 
 Signature file, required for B<-verify> operations only
@@ -147,6 +155,14 @@ Decrypt the input data using a private key.
 
 Derive a shared secret using the peer key.
 
+=item B<-encap>
+
+Encapsulate the secret using a public key. I<-secret> is required.
+
+=item B<-decap>
+
+Decapsulate the secret using a private key. I<-secret> is required.
+
 =item B<-kdf> I<algorithm>
 
 Use key derivation function I<algorithm>.  The supported algorithms are