It's a little confusing at first, but since 11.1, SEE exports a single MSI that contains all the components you select during the Client Package creation wizard (instead of creating 3 different MSI packages for Management Agent, Drive Encryption and Removable Media Encryption.)
Once the new client package is created though, it is just a matter of running the MSI via CLI. It will detect and upgrade SEE components without the need to decrypt.
The exact msiexec command can be found in the Upgrade Guide below (page 83):
https://www.symantec.com/docs/DOC9135
Please note though, that 11.2 has been out for a while now and 11.2MP1 for a month, and includes the usual round of bug fixes, and increased compatibiilty.