Nostr relays can also work over TLS encrypted connections. In fact most do. 
If the relay address starts with wss:// it is encrypted (web socket secure) and ws:// is unencrypted websocket connection.  

 Presumably big brother is doing mitm though. Something like I2P might be nice. 

 BTW thanks for pointing out wss and WS. I need to take a look at that.