A communications network comprising a plurality of computing devices, an access granting authority and an underwater communications system (110, 304), the underwater communications system being in communication with the access granting authority over a secure out-of-band point-to-point communication channel, the underwater communications system comprising: a network communication interface; one or more computer processors; and a memory containing computer program code that, when executed by operation of the one or more computer processors, performs an operation comprising: storing a plurality of data packets to be transmitted to a destination device; determining that data communications over the network communication interface have become available for a first network node; determining by a secure messaging module that the first network node has a valid security credential that has not been revoked by the access granting authority by determining that an identifier corresponding to the first network node does not match any identifier within a revocation list; wherein the access granting authority is further configured to perform an operation comprising: receiving an identifier, an address and proof of identification associated with the underwater communications system; then, based thereon, generating a private decryption key that is unique to the underwater communications system; then generating a public master key for use in generating an ephemeral copy of a public encryption key and an access denial master key for use in verifying revoked access to the public master key or the private decryption key, the private decryption key, public master key and access denial master key being configured for storage in the underwater communications system; and wherein the one or more computer processors of the underwater communications system are further configured to upon determining that the first network node has the valid security credential, transmitting the stored plurality of data packets in an encrypted manner using the generated ephemeral copy of the public encryption key over the network communication interface to the first network node, wherein the first network node is configured to employ store-carry-and-forward data messaging techniques to transmit the plurality of data packets towards the destination device. a network communication interface; one or more computer processors; and a memory containing computer program code that, when executed by operation of the one or more computer processors, performs an operation comprising: storing a plurality of data packets to be transmitted to a destination device; determining that data communications over the network communication interface have become available for a first network node; determining by a secure messaging module that the first network node has a valid security credential that has not been revoked by the access granting authority by determining that an identifier corresponding to the first network node does not match any identifier within a revocation list; wherein storing a plurality of data packets to be transmitted to a destination device; determining that data communications over the network communication interface have become available for a first network node; determining by a secure messaging module that the first network node has a valid security credential that has not been revoked by the access granting authority by determining that an identifier corresponding to the first network node does not match any identifier within a revocation list; wherein the access granting authority is further configured to perform an operation comprising: receiving an identifier, an address and proof of identification associated with the underwater communications system; then, based thereon, generating a private decryption key that is unique to the underwater communications system; then generating a public master key for use in generating an ephemeral copy of a public encryption key and an access denial master key for use in verifying revoked access to the public master key or the private decryption key, the private decryption key, public master key and access denial master key being configured for storage in the underwater communications system; and receiving an identifier, an address and proof of identification associated with the underwater communications system; then, based thereon, generating a private decryption key that is unique to the underwater communications system; then generating a public master key for use in generating an ephemeral copy of a public encryption key and an access denial master key for use in verifying revoked access to the public master key or the private decryption key, the private decryption key, public master key and access denial master key being configured for storage in the underwater communications system; and wherein the one or more computer processors of the underwater communications system are further configured to upon determining that the first network node has the valid security credential, transmitting the stored plurality of data packets in an encrypted manner using the generated ephemeral copy of the public encryption key over the network communication interface to the first network node, wherein the first network node is configured to employ store-carry-and-forward data messaging techniques to transmit the plurality of data packets towards the destination device.