I'm sure the traffic is encrypted. But it's trivially easy for Facebook to copy your private key to their servers.