The man page does say that but there is no mechanism to actually make use of that at the moment.
It's not enough for it to be encrypted, it needs to be encrypted with a single-purpose key that is not known by the user. Otherwise the user could replace the hibernation image with a malicious one and chain-load a backdoored version of Windows in secure boot mode, which violates the security model that Windows has and Linux needs to uphold to continue to get signed by Microsoft.
It is my understanding that there is work on generating a non-exportable single-purpose key using the TPM to make this work, but that's still a WIP.
It's not enough for it to be encrypted, it needs to be encrypted with a single-purpose key that is not known by the user. Otherwise the user could replace the hibernation image with a malicious one and chain-load a backdoored version of Windows in secure boot mode, which violates the security model that Windows has and Linux needs to uphold to continue to get signed by Microsoft.
It is my understanding that there is work on generating a non-exportable single-purpose key using the TPM to make this work, but that's still a WIP.