Why are we getting the CertPassword if http.sslKey is null (because the user isn't using client certificates)?

Also, C Git suggests the user set http.sslCertPasswordProtected if their key is encrypted with a password. If its not set, C Git doesn't prompt until later when the key is required and a password is needed. Is there some way we can tell if the key is encrypted and avoid prompting if this variable is unset and the key is not stored encrypted?