What is your threat model for 1? Leaking the message after it has been received or during transit?