This host serves the loader only. Authenticated clients receive a wrapped payload key and a single use stream.