F06-MT: Yes
Rationale
For selected direct messages, X25519-derived AES-CCM protects payloads between the two radio nodes. Relays do not terminate that encryption. The trusted serial client is inside the endpoint boundary; channel-key holders are not credited as private direct-message endpoints.
Assessment method
Documentary and code analysis; no execution
Source context
Meshtastic official documentation / pinned firmware 8e6a88d
Outstanding qualification
Validate ciphertext-only transit and endpoint/client key custody on the pinned hardware build; no radio capture or firmware execution performed.