I don't believe this is true. I believe that encryption is done at the CF node.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html

The highlighted statement implies that the client browser has the encryption key and encryption happens at the browser. I don' believe this correct.