The current option to get binary logs decrypted is mysqlbinlog used with the parameter --read-from-remote-server, as only the server has access to the keys via the Encryption Plugin API and Plugin. Be aware this adds load to the server.

I added a note about this to the documentation:

https://mariadb.com/kb/en/library/encrypting-binary-logs/#effects-of-encryption-on-mysqlbinlog

Just found out that there is NO WAY to read encrypted relay logs from outside the server. We really need to add decode capabilities to mysqlbinlog tool instead of relying on server to do the decode.