It doesn't, but that's not the point of it. It's to prevent passive spying, like opportunistic TLS for SMTP. I merely pointed it out because the OP was talking

It doesn't, but that's not the point of it. It's to prevent passive spying, like opportunistic TLS for SMTP. I merely pointed it out because the OP was talking about encryption done at the TCP layer. :)