Before we jump into what is encrypted, and what is not, what are the threat vectors we are actually concerned about?
With rqlite all traffic between the nodes can be encrypted, as can be the HTTP API. Yes, the data at rest is not, but there are many ways to protect that[1]. One way would be to use an encrypted file system, perhaps.
Encrypted data-at-rest is a valid request, but what use cases would it address?