Architecture (audit interview)
==============================

::

   Endpoint (keys stay here / HSM)
       │  HPKE content (NPE suite)
       │  routing: dest + subject in the clear
       ▼
   Untrusted NATS (cannot read bodies)
       │
       ▼
   Verae DataCube chain (append-only hashes)
       │  written through Peergos client
       ▼
   Peergos cryptree (encrypted names, sizes, graph)
       │  chunks → CID / hash
       ▼
   IPFS  (distributed, hash-verified ciphertext)

* **At rest:** Peergos cryptree + IPFS. Hosts with disk/backup see
  **opaque hashed ciphertext**, not PHI, if they lack keys.
* **In transit (NATS):** HPKE-Base to directory public keys. Broker is
  honest-but-curious: destinations yes, bodies no.
* **Integrity:** cube JSONL chain + dual hash + IPFS CID check on
  restore (re-fetch blocks, re-verify hashes — not a plaintext tape).

NATS remains an untrusted router. Production E2E is NPE/HPKE.
Passthrough means destination in the clear; the body is ciphertext.

.. only:: html

   Live: https://pfc.georgelambert.org/v1/npe/keys (public keys only).
   Controls: https://docs.pfc.georgelambert.org/controls.html

.. only:: latex

   See companion ``peergos-for-compliance.pdf`` (same folder) for
   controls, custody, and variables chapters.

   .. raw:: latex

      \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}