On 7280R/R2, "Configurable TPID" enables a TPID to be configured per switchport (default TPID on switchport is 0x8100). A packet is considered tagged (both from ingress and egress point of view) on an interface if and only if TPID of the outermost VLAN tag on the packet matches the TPID configured on the interface.  Up to 3 distinct (non-default) TPID values may be recognized per chip.

VLAN tagged MACsec refers to frames that have a VLAN tag between the MAC source address and the MACsec ethertype.  This VLAN tag is unencrypted (in the clear) so that intermediate devices between the MACsec endpoints can forward the MACsec frames based on this unencrypted VLAN tag.