There is no way to enable either PSK or Certificate encryption on hosts added through VM discovery. The options on the encryption tab is all greyed out and you can't even change it in the host prototype for discovery. This means if a host is created through discovery and later you add the Zabbix Agent for further monitoring of the OS or applications you cannot encrypt the data in transmission

This was mentioned in #ZBX-19687 which was closed but I don't think the person who closed it fully grasped what the OP was stating