Hi Piotr,
I believe that you are making a mistake in this video minute 3:39 when you say that decryption is done at an early stage, at the networking processing. You are confusing tunnel (IPSec or SSL) decryption with SSL/SSH packets decryption that occurs at a later stage (Fast Path) just before the App-ID and Cntent-ID phases.
Cheers
–Richard