Am I understanding that the clients do NO encryption. The encryption happens device to device. So theoretically there could be malicious code in the client. Effectively it is encrypted in transit. Just making sure I have the right framing.