and set an encrypt_transport according to your need (see the pipe driver).
The command you will call in that transport will need to pass the message
back to exim with protocol encrypted (-oMr encrypted). Search for amavis
and/or SpamAssassin for examples of such setups (I'm not sure there are
routers examples for SpamAssassin but there are for amavis).