Explanation
https://community.cisco.com/t5/wireless-mobility-documents/lag-link-aggregation/ta-p/3128669

Enabling control plane encryption on the wireless controller is crucial for establishing a secure mobility tunnel between the wireless controller and the anchor controller. Control plane encryption ensures that the signaling and management traffic traversing the mobility tunnel is encrypted, providing a secure channel for guest access authentication and authorization processes. This is particularly important when the anchor controller is deployed within a DMZ, as it is exposed to potential external threats. The Cisco Catalyst 9800 Series wireless controller supports control plane security features that can be leveraged to secure the mobility tunnel and ensure the integrity and confidentiality of the control traffic.