A method comprising the steps of: passing a first copy of a message derived from a sender and bound for a receiver through communication nodes of a switched-path network; when the first copy of the message passes through each of one or more of the communication nodes using authentication logic of one or more of said communication nodes to: generate a respective authentication tag (68, 86, 136, 138, 140) based on the first copy of the message and an intermediate authentication key (124, 126, 128) other than an end-to-end authentication key that is configured to be used to authenticate the message at the receiver and send the respective authentication tag (68, 86, 136, 138, 140) to the third-party authentication authority, wherein the respective authentication tag (68, 86, 136, 138, 140) is configured to enable a third-party authentication authority to identify whether the first copy of the message has been tampered with or corrupted upon arrival at that communication node by comparing the respective authentication tag (68, 86, 136, 138, 140) to another authentication tag (68, 86, 136,138,140) generated based on another copy of the message, and identify, independently of the third-party authentication authority, whether the first copy of the message is authentic using the end-to-end authentication key, wherein the first copy of the message comprises an authentication tag generated by the sender using the end-to-end authentication key; and transmitting, by the third-party authentication authority, instructions to the switched-path network to route messages around a troubled communication node of the communication nodes. passing a first copy of a message derived from a sender and bound for a receiver through communication nodes of a switched-path network; when the first copy of the message passes through each of one or more of the communication nodes using authentication logic of one or more of said communication nodes to: generate a respective authentication tag (68, 86, 136, 138, 140) based on the first copy of the message and an intermediate authentication key (124, 126, 128) other than an end-to-end authentication key that is configured to be used to authenticate the message at the receiver and send the respective authentication tag (68, 86, 136, 138, 140) to the third-party authentication authority, wherein the respective authentication tag (68, 86, 136, 138, 140) is configured to enable a third-party authentication authority to identify whether the first copy of the message has been tampered with or corrupted upon arrival at that communication node by comparing the respective authentication tag (68, 86, 136, 138, 140) to another authentication tag (68, 86, 136,138,140) generated based on another copy of the message, and identify, independently of the third-party authentication authority, whether the first copy of the message is authentic using the end-to-end authentication key, wherein the first copy of the message comprises an authentication tag generated by the sender using the end-to-end authentication key; and transmitting, by the third-party authentication authority, instructions to the switched-path network to route messages around a troubled communication node of the communication nodes. generate a respective authentication tag (68, 86, 136, 138, 140) based on the first copy of the message and an intermediate authentication key (124, 126, 128) other than an end-to-end authentication key that is configured to be used to authenticate the message at the receiver and send the respective authentication tag (68, 86, 136, 138, 140) to the third-party authentication authority, wherein the respective authentication tag (68, 86, 136, 138, 140) is configured to enable a third-party authentication authority to identify whether the first copy of the message has been tampered with or corrupted upon arrival at that communication node by comparing the respective authentication tag (68, 86, 136, 138, 140) to another authentication tag (68, 86, 136,138,140) generated based on another copy of the message, and identify, independently of the third-party authentication authority, whether the first copy of the message is authentic using the end-to-end authentication key, wherein the first copy of the message comprises an authentication tag generated by the sender using the end-to-end authentication key; and transmitting, by the third-party authentication authority, instructions to the switched-path network to route messages around a troubled communication node of the communication nodes.