On other words, while initially establishing trust is harder it is also harder for an attacker to execute an interception at that stage (mostly thanks to TLS). So this solution focuses on fending off the more common, more easily accomplished attack of stolen credentials from storage. Do I have that right?