🚀 go-pugleaf

You should distinguish between encipherment, which is basically a
transmission function aiming at a particular quality of service, i.e.
confidentiality, and signatures, which are clearly dependent of end
users interaction, thus located in the application layer. 

In principle, the same application could run either in encrypted or
plain mode without much consequences. After all, confidentiality of the
transmission could be provided by many other means, e.g. miliotary
guarded shielded cables; usage of end to end encryption appears to me
very much the same as using end to end checksum, i.e. a particular
transport function that is applied when one does not trust the network. 

The tricky point of the application layer signature or encryption
mechanisms is that they should be based on the ``abstract syntax'' of
the data. There is one approach in X.500.

Christian Huitema