Restraint

The adversary I didn’t have

I spent an hour designing cryptographic authentication against an attacker who doesn’t exist in my setup. On matching enforcement to the threat you actually have — and why a fake guarantee is worse than a named limit.