So Damien and I verified that traffic is correctly encrypted when it is set. The work left here is to fix up upgrades. We're discussing approaches in the linked gerrit review
This works for SSL deployments in OSP12 and the upgrade case is less relevant because it's not possible to move from a non-SSL deployment to an SSL deployment in the general case.