Architecture (audit interview)

Endpoint (keys stay here / HSM)
    │  HPKE content (NPE suite)
    │  routing: dest + subject in the clear
    ▼
Untrusted NATS (cannot read bodies)
    │
    ▼
Verae DataCube chain (append-only hashes)
    │  written through Peergos client
    ▼
Peergos cryptree (encrypted names, sizes, graph)
    │  chunks → CID / hash
    ▼
IPFS  (distributed, hash-verified ciphertext)

• At rest: Peergos cryptree + IPFS. Hosts with disk/backup see opaque hashed ciphertext, not PHI, if they lack keys.

• In transit (NATS): HPKE-Base to directory public keys. Broker is honest-but-curious: destinations yes, bodies no.

• Integrity: cube JSONL chain + dual hash + IPFS CID check on restore (re-fetch blocks, re-verify hashes — not a plaintext tape).

NATS remains an untrusted router. Production E2E is NPE/HPKE. Passthrough means destination in the clear; the body is ciphertext.

Live: https://pfc.georgelambert.org/v1/npe/keys (public keys only). Controls: https://docs.pfc.georgelambert.org/controls.html