There appears be to a bug in Cinder as well, but I'm opening this one to track the Nova effort.
At the moment, when a user requests an encrypted volume to be attached to an instance (boot volume or otherwise), the request succeeds and the user believes that the attached block device is encrypted.
It turns out that the RBD driver in Cinder fails to setup and return the necessary encryption metadata to Nova, and Nova appears to carry on as if encryption was not requested. Although the problem lies mostly in Cinder, Nova should be able to track this and report this to the user.