Did you ever get a chance to test this? Since the encryption happens in Hardware, presumably after the SPAN process in software replicates the switchport's outbound buffer, I assume you see the cleartext contents?
In which case, you would need a passive optical splitter to observe the encrypted traffic on the wire.
