A gbde device's physical path should be the underlying provider's with "/bde" appended, if the underlying provider has a non-null physical path itself.
Turns out this isn't as important as I thought. gbde(8) currently doesn't even support BIO_GETATTR. That means that zfsd will never use a gbde device for a physical path replacement, which means that zfsd will never replace a ZFS disk with the bare drive when it should be using the .bde version. Since there's no risk of mishandling encrypted information, and I don't want to add features to the obsolete GEOM transform, I'm going to close the bug.