I think that the gateways in question are configured such that, if no encrypted message is found, the email is passed through.

IMO, you can have a publicly-IPed encryption gateway, under one condition: If inbound email is received that does not properly decrypt & verify, that message is either bounced or dropped.