between citizens of the citadel, letters are sealed at the senders own desk, on the senders device, using the recipients public key. the envelope never travels unlocked and never exists readable anywhere but the two desks that matter. that is end-to-end encryption in the mail service that started in 2014: not a promise, an order of operations