I think that if you are worried about someone sniffing salary info in your org, there are deeper problems to sort out. There isn't really something like "casua

I think that if you are worried about someone sniffing salary info in your org, there are deeper problems to sort out. There isn't really something like "casual sniffing". It has to be done deliberately and with full intent. Not to mention with the right timing or long duration and non trivial technical knowledge. It isn't really possible to protect against such an adversary (for example, even with self signed certs, he can mitm the connection and resign it himself), and therefor imo, its better not give a false sense of security.