[amaccuish]

It doesn't, but that's not the point of it. It's to prevent passive spying, like opportunistic TLS for SMTP.

I merely pointed it out because the OP was talking about encryption done at the TCP layer. :)