disclaimer: no crypto expert.<p>There&#x27;s a concept of authenticated encryption, so your connection isn&#x27;t just confident, you&#x27;re also making sure nobody tampered with the content. There are multiple ways to assure that.<p>There is a RFC for EtM in TLS: <a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc7366" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc7366</a><p><pre><code>   This document describes a means of negotiating the use of the
   encrypt-then-MAC security mechanism in place of the existing MAC-
   then-encrypt mechanism in Transport Layer Security (TLS) and Datagram
   Transport Layer Security (DTLS).  The MAC-then-encrypt mechanism has
   been the subject of a number of security vulnerabilities over a
   period of many years.
</code></pre>
That also describes MtE. GCM in itself is already authenticated so it skirts the migration issue.