Jafar on Nostr: Is Nostr encrypted during transit? If not, would it be difficult to implement it, and ...

Is Nostr encrypted during transit? If not, would it be difficult to implement it, and how?

I’m asking because although sent messages are signed, any unencrypted data client to relay, or relay to relay, that is received and not signed from a known pub key, could originate from a man in the middle attack.