F21-MT: Yes
Rationale
For confirmed-key direct messages, Router verifies AEAD and sets pki_encrypted plus the validated full sender public_key on the decoded MeshPacket. RoutingModule passes local delivery to MeshService; handleFromRadio copies the whole packet into the phone queue. PhoneAPI copies that packet into FromRadio and serializes it, preserving the identity and payload binding without another application authentication exchange. Credit concerns PKI direct messages and the trusted local API, not arbitrary channel traffic, cached NodeInfo or civil identity.
Assessment method
Read-only code analysis and explicit topology inference
Source context
Pinned Meshtastic firmware: forwarding, authenticated receive and client serialization
Outstanding qualification
Exercise the serial API with valid, forged, changed-key and non-PKI messages. Confirm identity fields stay bound to each item through queuing and serialization; no client UI or hardware test performed.