How can I securely encrypt spatial fields (GeoDjango / PostGIS) in Django?

To my knowledge, there's no on-the-shelf solution for encryption-at-rest with PostGIS. So most likely, you won't be able to preserve GIS-operations if you want encryption.

If that much is fine, then the rest of the question becomes easier - because now you can use two FloatField instead and keep those encrypted. To preserve a mostly GIS-like API contract, our old OOP friends to the rescue - getters and setters.

from django.contrib.gis.geos import Point
class SomeModel:
    lat = encrypt(models.FloatField())
    lon = encrypt(models.FloatField())
    @property
    def location(self):
        return Point(self.lon, self.lat)
    @location.setter
    def location(self, point: Point):
        self.lon = point.x
        self.lat = point.y

Aside from not being able to do GIS transformations/comparisons at the queryset level, consumers won't know the difference between this and a model where location is a PointField.

One caveat is that this doesn't work out of the box in the admin panel, you'd have to create a custom form to handle interfacing with the getter and setter.