This is what we currently have implemented through the regular filter setup.

You would simply enable the filter for all incoming messages and the filter decides whether it needs to encrypt or re-encrypt. Performance-wise there's would be no gain in introducing a Match rules like "Is encrypted" or "Is not encrypted". Also I don't think it would be faster or easier, as just selecting "Apply to all" is certainly easier than having to create two filters with If is encrypted then re-encrypt and If is not encrypted then encrypt logic.

Or is there something I'm missing?

The main use case that is currently not fulfilled afaik (or only if you filter on headers / mail content) would be:

• Only re-encrypt incoming encrypted mails (Leaving unencrypted mails untouched)

I see, it wasn't clear to me from the description that this is a scenario too. In that case the match rule makes sense.

confirmed in a test.

Set up a filter and run the filter directly from the filter-settings window and it works.

Confirmed. I created a filter to play a beep on every encrypted (tested for non encrypted messages, too) message. When run directly from the filter settings it does the correct thing.