I don’t know if @Brad had the time to test my idea of hidden appVMs, and by the way it’s not really the same thing as simply encrypting appVMs, but I came with a crude suggestion to use an equivalent of encrypted AppVMs, manually though.
You can pop up any disposable VM and attach a disk via xl block-attach DOMID '/path/to/file.img,,xvdX' (changing capital X accordingly, also note this can’t be an hdX/sdX type, as only the PV interface is supported in domUs).
The “file.img” is containing TrueCrypt-like volumes (or even LVM/ZFS encrypted pools). You then mount it from inside your disposable, and can use encrypted data as you wish.
Of course this needs manual tweaking if using apps needing the data inside the encrypted file (symlinks, etc). Or just install the apps in the encrypted container.