Which method is most suitable for protecting data when it must traverse untrusted intermediate nodes?