Turns out we do want to propagate packets unauthenticated in the supernode case. This is fine.