And with required authenticated encryption, one would hope an intervening switch or router couldn't accidentally forge a message that's supposed to be hard to forge when you're trying.