I was just looking into that a few days ago. There is only one giftwrap in whitenoise proto. For being invited into a group. After that it's built for wide open download for all those events. The changing/rotating of the keys is it's only protection (nothing on the internet I know of exposes it's data that widely).. Seemed strange to me. But your assessment is correct and using AUTH does not seem like it can help them much. (other than protecting the join event).