If you configure two-way replication like a High Availability replication, then you will be setting up encryption from Export on Primary to Import on Secondary as a first step.
The second step would be to set up encryption from Export on Secondary to Import on Primary, if you wish to have encryption for replication going in reverse direction.
So these will be two different sets of encryption which will be independent of each other because the Export process on Primary is different from Export process on Secondary.
Regardless of which server becomes Primary (due to failover), there will be no need to change the encryption during the role reversal from Primary to Secondary and vice versa.
The reason is obvious, namely there are two different set of Export processes each from Primary to Secondary and vice versa, and the role reversal does not change the Export process.
For more details on encryption, please refer to SharePlex Administrator Guide section titled “Encrypt data between Export and Import”.
