[qqii]

The sarcophagus is Enc_arch(Enc_recip(data)) so unwrapping it off chain isn't useful to them.

The only case it would be useful is if they collude with the recipient. I'm not sure how this procotol disincentives this.

[Imnimo]

Right, I get that, but presumably I don't want the recipient to have it unless the switch goes off, or else I wouldn't be using this system - I'd have just given it to the recipient unencrypted.

[qqii]

That's why the archaeologists are supposed to be a disinterested third party, you essentially pay them (and they forfeit their collateral) to not unwrap it.