Question:

At what layer of the OSI layer does the encryption and decryption of the message happen if user A is writing a sensitive email message to user B outside the local network and user A has chosen to use PKI to secure his message and make sure only user B can read the sensitive email?