F06-I2: Yes
Rationale
Garlic encryption protects destination messages beyond the layered tunnel protection, so outbound tunnel endpoints and inbound gateways are not the plaintext recipients. This credits destination-level delivery, not merely NTCP2 transport encryption, and does not add the unselected Streaming library.
Assessment method
Individual review of inherited classification; no protocol execution
Source context
Primary specification / explicit endpoint and observer scope