They are not encrypted but signed with an elaborate algorithm (I worked on ActivityPub server implementation).

Twtxt is minimalist but functional: https://github.com/buckket/twtxt