&gt;As a side bonus, with proper encryption you can be sure that network errors which corrupt your packets are not going undetected<p>Shouldn&#x27;t you be verifying a MAC before decrypting anyways? Relying on decrypting scrambled data, especially for a bitflip, seems like a bad idea.<p>&gt;Potential attack here is about attacker modifying the (unencrypted&#x2F;unsigned) data coming to the victim’s Client,<p>So establish a session key, and include an HMAC on each message? Or not even a session key, if you&#x27;re worried about re-establishing sessions, but a long-term per-client key (or per-install or whatever). Hardly seems like you need QUIC&#x2F;DTLS for this simple scenario.<p>Then all the part about DDoS&#x27;ing a UDP connection establishment... Why not just use TCP for sign-in and key establishment, and get 3-way handshake for free. That eliminates spoofing IPs. From there, just have monitors that determine when you&#x27;re &quot;under attack&quot; and rate limit by IP address, just like any anti-DDoS does. Coming up with all this other stuff seems like an overly complex way.