fwmark is used internally during firewall processing, and no mark
remains on egress. Yes, the fwmark is to identify egress encrypted
packets, but no egress packet itself contains this value, and
this metadata disappears once the packet leaves the firewall.
The current wording is ambiguous, since "for" does a lot of lifting.
"during" helps limit the scope of this definition.
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
b4e1052331