I think if the backups is encryptet or not is not relevant, because the data is stored in "unlogical" chunks. You have one hash for every chunk and when you verify the backups the hash gets new calculated and compared with the old value.
Correct me if i am wrong.
for encrypted backups/chunks, only the CRC checksum is verified (and the index checksums contained in the manifest), the full chunk digest can only be verified by a client that has the full key.