Use mdfind to identify all encrypted dmg? Can someone suggest a clever way to identify all dmg that are encrypted?

My only idea is rather complicated. use mdfind '(kMDItemFSName=*.dmg)' and then test the response from hdiutil imageinfo and log the result of those that ask for a password. Thanks to the answer and comments, the following command runs all the dmg through hdiutil, but I can't figure out how to identify the ones that give an error. Any ideas?

mdfind -0 "kMDItemFSName=*.dmg" |xargs -0 -I{} -L 1 hdiutil imageinfo {}
Spotlight just doesn't have sufficient metadata to differentiate the filesystem choices stored inside a DMG. Put another way, it's like asking what Pages documents have French words in them just using mdls. The data to make that search isn't contained in metadata.

The proper command to check if a specific image file is encrypted is hdiutil isencrypted /path/to/dmg

Example:

host:~ user$ hdiutil isencrypted /Users/user/Downloads/test.dmg


Output:

encrypted: YES
blocksize: 512
uuid: DE78A7BE-2B64-4556-8EC9-93DFAC15A839
private-key-count: 0
passphrase-count: 1
max-key-count: 1
version: 2