Well, I made this work. If you are running into this issue, you can probably fix it this way, but I'm no expert at regex.
Here is the code that is in the syslog-ng package now, found in /usr/local/pkg/syslog-ng.inc:
preg_match("/\bfile\b\(['\"]([^'\"]*)['\"]/", base64_decode($object['objectparameters']), $match);
That is supposed to fix the "encrypting the keyfile" behavior, but it doesn't. This is at line 238 according to the redmine page here https://redmine.pfsense.org/projects/pfsense-packages/repository/revisions/c030cf2781c7bbef197db6f07facef35b6856c8e/diff
In order to get this thing to STOP encrypting the keyfile, I changed line 238 to this:
preg_match("/[^-]\bfile\b\(['\"]([^'\"]*)['\"]/", base64_decode($object['objectparameters']), $match);
Once I change this and re-saved, with no changes, my custom Destination object in syslog-ng (restarting the syslog-ng service does NOT make this change take effect), the /usr/local/etc/logrotate.conf no longer includes the key file, but it DOES still include the syslog-ng log files.
One other thing - while youa re editing the /usr/local/pkg/syslog-ng.inc file, chenage the line
$conf .= "@version:3.6\n";
to
$conf .= "@version:3.5\n";
otherwise the syslog-ng service will not start.
