The key to solution is "Ethernet frames". Frames are layer 2. IPsec encrypts at layer 3.
https://developers.redhat.com/blog/2016/10/14/macsec-a-different-solution-to-encrypt-network- traffic/

The key to solution is "Ethernet frames". Frames are layer 2. IPsec encrypts at layer 3.

Option B provides the required combination of performance and failure isolation. The 10-Gbps interface is retained as the preferred active path so backup traffic uses the fastest available server link. The standby connectivity is placed across the vPC leaf pair, ensuring that failure of the active NIC, its cable, or the attached leaf does not isolate the backup server. Cisco's vPC design guidance supports dual-homed server connectivity and emphasizes fast convergence after a link or peer-device failure. It also recognizes active
/standby attachment as a supported design when the host is not using an active-active port channel. The three unequal-speed interfaces should not be forced into one Ethernet port channel: member links in a port channel must have compatible operational characteristics, and combining 1-Gbps and 10-Gbps members would not create a valid, predictable bundle. Instead, host NIC teaming or bonding should select the 10-Gbps NIC as active and use a physically diverse 1-Gbps NIC as passive recovery. Option A concentrates the useful recovery connectivity in a way that leaves a leaf-level failure domain. Option C introduces an unnecessary intermediary switch, adding another device and potential failure point. Option D does not use the available interfaces in the required active/passive, speed-preferred arrangement. Thus, Option B minimizes normal backup duration while preserving an alternate path through a different vPC peer. Cisco vPC best-practices design guide