Can I sync between encrypted and plaintext .env files?

Yes. Dotvault quietly decrypts .env.encrypted files during sync, so you can compare and sync keys between .env.production and .env.production.encrypted exactly the same way you would with any other pair of env files.