[evanphx]

Templar is designed to be used within your own infrastructure on a trusted network, where you talk to it and it talks to the outside world.

An attacker would have to be already within your private network, and if they were, they could observe the traffic in plain text already.

I think the confusion is around where Templar sits in relation to your app making HTTP API calls and the services you want to talk to. I'm going to draw up a diagram to help explain this better.