Hmm, shouldn't this be alleviated with RELP [1]? (which the author suggest you use).

Because, otherwise, since AFAIK rsyslog doesn't support DTLS it means unencrypted log transmission. (For RELP it also means running stunnel anyways, which supports DTLS, and may be a solution)

[1]: http://www.librelp.com/