Comment by scosman

I feel like I’d rather send “uuid:cipertext” so the cipertext never touches a server, but logically the security seems the same.