Thank you for this long answer. Actually, I have always wondered why it isn't possible to treat the stream as arbitrary data, so it can be encrypted and decrypt

Thank you for this long answer. Actually, I have always wondered why it isn't possible to treat the stream as arbitrary data, so it can be encrypted and decrypted in "userspace". Something like how Firefox Send works, with a key as a URL fragment. E2EE with intermediate forwarding peers unable to decrypt the contents.