Nostr relays can also work over TLS encrypted connections. In fact most do.

If the relay address starts with wss:// it is encrypted (web socket secure) and ws:// is unencrypted websocket connection.