I forgot the mention the most relevant aspect; that because you could run a node on-premises which syncs up with all the latest domains, may not even need encryption... But if you didn't want to run your node on-premises, you could have an encrypted tunnel to someone (or a company) which does.