Encrypting the RPC traffic between domain controllers would then be a viable various for replication over the common public Internet when you could have a devoted connection between sites.