Nostr relays can also work over TLS encrypted connections. In fact most do. 
If the relay address starts with wss:// it is encrypted (web socket secure) and ws:// is unencrypted websocket connection.