Clarify that deduped data is encrypted

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: George Melikov <mail@gmelikov.ru>
Reviewed-by: Tom Caputi <tcaputi@datto.com>
Signed-off-by: Richard Laager <rlaager@wiktel.com>
Closes #8691 

man/man8/zfs.8

@@ -2388,7 +2388,8 @@ directory listings, FUID mappings, and
 .Sy groupused
 data.  ZFS will not encrypt metadata related to the pool structure, including
 dataset and snapshot names, dataset hierarchy, properties, file size, file
-holes, and deduplication tables.
+holes, and deduplication tables (though the deduplicated data itself is
+encrypted).
 .Pp
 Key rotation is managed by ZFS.  Changing the user's key (e.g. a passphrase)
 does not require re-encrypting the entire dataset.  Datasets can be scrubbed,