usage: aws-crypto [-h] (--version | [-e | -d]
[-m MASTER_KEYS [MASTER_KEYS ...]]
[-C CACHING [CACHING ...]] [-i INPUT] [-o OUTPUT]

IIRC, this is a left-over from before I remembered that argparse has special built-in handling for version outputs. This should be a simple matter of marking these as required and removing the special handling to enforce them outside of the argparse configuration.