Symantec has a lot of great documentation for creating WinPE boot media with the PGP drivers baked in for one-off situations. Unfortunately those instructions don't speak to organizations with MDT ...