Note that Instagram doesn't encrypt requests to their private API, they're only signing them. In fact the parameter is called 'signed_body', not 'encrypted_body'.
The traffic is encrypted over SSL (HTTPS), so there's no need for double-encryption, since presumably the app can trust the DNS and certificate chains on the device. If I were a paranoid Instagram developer, though, I could even use a custom certificate chain that only trusted certificates on my server, so there's no point to doing the encryption in the app.