Yes, they assume that the sending/receiving machines arent themselves compromised. That case, however, doesnt have a solution as of yet (that I know of). The point is that any machine intercepting the transmission of the message has no way of possibly decoding it period. It absolutely requires the key to be decoded.