Ok, so the uplink gateways don't actually sink/source packets to the cleartext Internet, they have one more (encrypted) hop to your datacenters first?