Assumptions

• Netlets completely trust their local node. Netlets are defenceless against their node. Assuming the netlet cares, it must trust the node it is running on.
• Netlets trust the services they use to some extent. Otherwise, services would not be useful.
• Nodes are mutually suspicious. Nodes can be altered or subverted, hence there is no reason why one node should trust another.
• Netlets are suspicious of other nodes. As above.
• Netlets are mutually suspicious. Netlets could be written with malicious intent, hence there is no reason why one netlet should trust another.
• Nodes are suspicious of all netlets. As above.