At what point do we design networks with the Trust No One principal? What would that look like?