The point here is avoiding replay attacks somehow… just encrypting will allow “hackers” to replay a logout.