Hi,
Are you altering the system alert template(s)? Those are mapped to operators, not recipients.
If they were recipients you could use @cryptedId, no need to call cryptString() function- or better, use a common unsub personalization block.
Finally, operators can't use webApps to unsubscribe from alerts; unless the webApp is written in such a way as to delete the row from the nmsgroup bridge table connecting them to the alert group every workflow is set to use...
Thanks,
-Jon