A method for providing end-to-end security for transport of a sensitive packet from a source node to a target device through an infrastructure based on a policy, the method comprising: determining, by the source node, the policy, the policy enforcing at least one of a transport, an installation, or a consumption of the sensitive packet by the target device or a node of the infrastructure through which the sensitive packet is intended to be transported (108, 502, 506, 508, 510, 512, 514, 516, 518); appending, by the source node, the policy as data fields of the sensitive packet prior to transport of the sensitive packet, wherein the sensitive packet is encrypted for end-to-end confidentiality protection between the target device and an initial node of the infrastructure through which the sensitive packet is initially transported, wherein the encryption for end-to-end confidentiality protection is an end-to-end inner layer encryption and is performed prior to a hop-by-hop encryption; cryptographically signing, by the source node, the sensitive packet; and causing the sensitive packet to be transmitted to the target device through at least the node of the infrastructure (108, 502, 506, 508, 510, 512, 514, 516, 518); wherein the policy requires a required node path through the infrastructure and for each node of the required node path to cryptographically sign a prescribed part of the sensitive packet responsive to determining that the node is identified as in the required node path; wherein determining whether a policy for secure packet transmission was followed for a packet is based on: determining, by the target device or the node of the infrastructure (108, 502, 508, 510, 512, 514, 516, 518), based on cryptographic signatures, an actual node path of the packet through the infrastructure, the actual node path indicating the actual source node and one or more actual intermediate nodes; and determining, by the target device or the node of the infrastructure (108, 502, 508, 510, 512, 514, 516, 518), whether the actual node path of the packet matches the required node path of the packet. determining, by the source node, the policy, the policy enforcing at least one of a transport, an installation, or a consumption of the sensitive packet by the target device or a node of the infrastructure through which the sensitive packet is intended to be transported (108, 502, 506, 508, 510, 512, 514, 516, 518); appending, by the source node, the policy as data fields of the sensitive packet prior to transport of the sensitive packet, wherein the sensitive packet is encrypted for end-to-end confidentiality protection between the target device and an initial node of the infrastructure through which the sensitive packet is initially transported, wherein the encryption for end-to-end confidentiality protection is an end-to-end inner layer encryption and is performed prior to a hop-by-hop encryption; cryptographically signing, by the source node, the sensitive packet; and causing the sensitive packet to be transmitted to the target device through at least the node of the infrastructure (108, 502, 506, 508, 510, 512, 514, 516, 518); wherein the policy requires a required node path through the infrastructure and for each node of the required node path to cryptographically sign a prescribed part of the sensitive packet responsive to determining that the node is identified as in the required node path; wherein determining whether a policy for secure packet transmission was followed for a packet is based on: determining, by the target device or the node of the infrastructure (108, 502, 508, 510, 512, 514, 516, 518), based on cryptographic signatures, an actual node path of the packet through the infrastructure, the actual node path indicating the actual source node and one or more actual intermediate nodes; and determining, by the target device or the node of the infrastructure (108, 502, 508, 510, 512, 514, 516, 518), whether the actual node path of the packet matches the required node path of the packet. determining, by the target device or the node of the infrastructure (108, 502, 508, 510, 512, 514, 516, 518), based on cryptographic signatures, an actual node path of the packet through the infrastructure, the actual node path indicating the actual source node and one or more actual intermediate nodes; and determining, by the target device or the node of the infrastructure (108, 502, 508, 510, 512, 514, 516, 518), whether the actual node path of the packet matches the required node path of the packet.