Are the protected download links encrypted/obfuscated?

No, they are not and the reason is simple: Browser cannot read obfuscated links, they have no idea what to do with it. Since the links expire and your bucket/download distribution is private, there is no need for encryption because the only way to get to the file(s) is via your pages using this plugin. When a page is reloaded, a new expiring URL is created.

If you still feel uncomfortable about that, you add an extra layer of protection to restrict access to your bucket only via the IP address of your server. See also:
Does the plugin allow to restrict downloads from a fixed IP address only?

Note: signed URL's for video and audio can be set to obfuscated.

Updated: December 18, 2017