Answer: Use Secure Message when two parties with separate key pairs exchange data, and Secure Cell when a single party encrypts data for itself. The deciding question is whether both ends could ever hold the same secret key.

Secure Cell is symmetric, so shipping it to a client for client-server traffic means embedding a key the server also holds — extract it from one device and every user's traffic is readable. Secure Message is asymmetric: the device keeps a private key the server never sees, so compromising the server does not let an attacker forge requests from a device.

Key Points:

• Secure Cell → data at rest, one owner, one key.
• Secure Message → data in transit between two identities.
• A symmetric key that must exist on both the client and server is a design smell.