The dig output for the speakers is always encrypted (point)
Not correct: As already mentioned by other hikers, the output is not encrypted in legacy mode, which is enabled by disabling 96/24 support for that speaker in the speaker config. Older DSP speakers like the 18 bits versions of the 5000, 5500 and 6000 do not support encryption and are limited to 48kHz.
The digital data to the analog outputs is also always non-encrypted and 96/24, so adding a SPDIF encoder to the I2S lines to the DACs will also provide a non-encrypted digital output. The only problem is that you have to keep the volume at the reference level (87) because of the hybrid volume system to get 100% output.