Yes, a DS-Client can forward the encryption keys to a replication DS-System, this can be useful if a remote DS-VDR restore has to be performed from the replication DS-System. In order to forward the keys, you must temporarily make as "primary" the IP of the replication DS-System in DS-User > Setup > Configuration > Connections.