This sounds like an intresting task for the free time, anyway corrent me if I'm wrong (and I probably am) but pulseaudio controls witch inputs/outputs are used , and it supports plugins (EQ for example), so my logic is:
If PA supports plugins, and controls the audio streams on the N900, the most easy way to add "encryption call" competability will be by adding a plugin witch does the en/de cryption to PA. (loaded/used only when needed ofc, not all time)
So my question is , am I thinking in the right direction ?