Why Sticky Flags Matter
Device -> Relay1 -> Relay2 -> Collector
Suppose Device is old-style, messages aren't protected until Relay1
If we don't tell Collector, it will assume all these messages from Relay2 are authenticated.
This is worse than no cryptography--user of logs can't tell what is really authenticated and what's not.