A system coupling a first endpoint location to a second endpoint location, comprising: a routing overlay network comprising a set of machines distributed at least in part across Internet locations, the routing overlay network comprising an ingress point associated with the first endpoint location, and an egress point associated with the second endpoint location; a first apparatus connected to the ingress point; a second apparatus connected to the egress point; the first and second apparatus each comprising: computer memory holding computer program instructions executable by hardware processors and operative to: configure and maintain first and second encryption contexts, the first encryption context extending end-to-end between the first apparatus and the second apparatus, the second encryption context having a set of transport protocol segments including a first outer transport protocol segment between the first apparatus and the ingress point, a second outer transport protocol segment between the egress point and the second apparatus, and an intermediary protocol segment between the first and second outer segments; the first encryption context protecting data flow end-to-end between the first apparatus and the second apparatus; and the second encryption context protecting transport and network protocol layer headers; wherein the computer memory in each apparatus (1604. 1606) stores a key, the key being adapted to enable decryption in association with the second encryption context to enable access by the routing overlay network to the transport and network protocol layer headers; and wherein the key does not enable access to the data flow, the data flow remaining encrypted as it traverses the overlay network between the first apparatus and the second apparatus. a routing overlay network comprising a set of machines distributed at least in part across Internet locations, the routing overlay network comprising an ingress point associated with the first endpoint location, and an egress point associated with the second endpoint location; a first apparatus connected to the ingress point; a second apparatus connected to the egress point; the first and second apparatus each comprising: computer memory holding computer program instructions executable by hardware processors and operative to: configure and maintain first and second encryption contexts, the first encryption context extending end-to-end between the first apparatus and the second apparatus, the second encryption context having a set of transport protocol segments including a first outer transport protocol segment between the first apparatus and the ingress point, a second outer transport protocol segment between the egress point and the second apparatus, and an intermediary protocol segment between the first and second outer segments; the first encryption context protecting data flow end-to-end between the first apparatus and the second apparatus; and the second encryption context protecting transport and network protocol layer headers; configure and maintain first and second encryption contexts, the first encryption context extending end-to-end between the first apparatus and the second apparatus, the second encryption context having a set of transport protocol segments including a first outer transport protocol segment between the first apparatus and the ingress point, a second outer transport protocol segment between the egress point and the second apparatus, and an intermediary protocol segment between the first and second outer segments; the first encryption context protecting data flow end-to-end between the first apparatus and the second apparatus; and the second encryption context protecting transport and network protocol layer headers; wherein the computer memory in each apparatus (1604. 1606) stores a key, the key being adapted to enable decryption in association with the second encryption context to enable access by the routing overlay network to the transport and network protocol layer headers; and wherein the key does not enable access to the data flow, the data flow remaining encrypted as it traverses the overlay network between the first apparatus and the second apparatus.