Then instrument the endpoints. Surely a developer has code level access and can inject a debugger, logs session keys for later decryption, or intercept the cryp

Then instrument the endpoints. Surely a developer has code level access and can inject a debugger, logs session keys for later decryption, or intercept the crypto api calls to inspect preencrypted values. Https does nothing to prevent, help nor hinder the visibility to the developer. It merely provides confidentiality of communications between two endpoints, which is a highly desirable property in secure systems.