Also, the problem assumes that padlocked boxes themselves are not stolen. Presumably we're expected to consider this a reasonable assumption, because a thief wo

Also, the problem assumes that padlocked boxes themselves are not stolen. Presumably we're expected to consider this a reasonable assumption, because a thief wouldn't bother stealing a box that they couldn't open. But just as with public-key cryptography, a thief who can both steal packages and forge return addresses could intercept the box, place their own padlock on it, and then execute the rest of the protocol to perform a classic man-in-the-middle attack.