[hinkley]

Caching or other forms or retransmission of the data.

Not all signed content is meant to be confidential. Or two-party confidential. Think about tokens. You have a refresh token that’s private between you and the destination, but you hand out session tokens to your users so they can talk to the destination directly. Or via another server that doesn’t have a cache coherency with the source.

[hughes]

Thanks, that makes sense.