The actual rules say you're not allowed to obscure the meaning of a message. Use of encryption itself is not specifically prohibited, but you're not allowed to hide the information being sent. So, "encryption" is technically allowed for things like authentication and signatures, under most interpretations of the rule.
It is correct that you're not allowed to use your ham license for any commercial purpose. But again, there are narrow exceptions: a teacher getting paid to teach a class on amateur radio or science in general can transmit to demonstrate the technology, or an astronaut or military member making contacts with amateurs for goodwill purposes or as part of an exercise.
There are plenty of other anything-goes bands for you to use, there's literally no reason to do your pirate radio on the ham bands. Except to get those warm fuzzy counter-culture feels I guess.
That said, balancing this with modern needs for security and privacy is a real challenge. Good communication protocols today are designed with these protections in mind, and the inability to use encryption arguably limits what amateur radio enthusiasts can do with newer radio technologies.
Privacy, however, has traditionally not been part of ham radio—this is why you’re required to identify yourself with a call sign, and contact info is publicly available. The identity of the sender is expected to be open. Maybe there’s room to allow for some privacy around the content of the message itself, but the sender’s identity should still be clear. I’m not sure what the right balance is, but simply allowing complete encryption that hides the message, the transmitter’s identity, and the transmission protocol itself doesn’t seem to align with the purpose of amateur radio.
The ‘trash bands’ (ISM bands) are probably a much better place for experimenting with full-bore encryption and privacy. From these experiments, we might learn a balanced approach that could be backported to the amateur spectrum, preserving the spirit of why these bands exist while adapting to modern privacy needs.
And you can do encryption, when you have to control remote devices which belong to you.
and internet still can be non commercial.