Is there any publicly available example of Read method in custom provider? I’m trying to figure out how to combine Read on new and existing resources for importing.

The expectation is that Read will be able to get the existing properties, because well that's what its for,

As you mentioned, I wanted to encode existing pgp data into ID so Read would work with importing

But I’m not sure how to also set up Read to access data on refresh, since it would not have data in ID, but the keys still exist somewhere in state.

I’m probably just being dumb and missing something obvious.

We've had a few things come up where people want something stateful but don't really have anywhere to store that state and want to just use the pulumi state. Currently we don't really have a good way to do that, no defined interfaces at least. You could just manually edit the state file JSON to add your keys, if you've just got a couple of these as a one off that would be my recomendation. If you think this is going to be a recurring scenario it'd be worth raising an issue on our github discussing this, we can then track that and see about adding a feature to have some sort of first class state access.

But that probably wouldn’t work with properties marked as secret right? Any way I could manually encrypt them?

then just delete the config value once done. Again I think there's merit here to giving people first class support to state "somehow" and that would support secrets