At the end of the day, said Encryption module, while exposing encrypt, decrypt function, would also access the rest of the reliable channel API, and be able to track and refer to knowledge provided by the SDS layer.
As you said, we will probably need to cater for out-of-order messages, meaning if one cannot decrypt a message, we may park it at a later stage, the same way that we park SDS messages without a resolved causal history in an ingoing buffer.
Moreover, right now the proposed reliable channel API does not expose too much of the causal ordering of messages. This is something we started to discuss both with opchan and SolarPunk to understand what would be the ideal API.