Answer: TLS protects the connection, not the message — it ends at the first thing that terminates it, which may be a load balancer, a logging proxy, or an attacker's intercepting certificate on a compromised device. Payload-level crypto keeps the body opaque past that boundary, so breaking TLS yields ciphertext rather than account data.

The concrete iOS threat is mundane: a jailbroken device with a tweak that disables certificate pinning, or a user tricked into trusting a root profile, turns a proxy into a full read/write view of the traffic. With Secure Message on top, the attacker sees only wrapped blobs and cannot forge a request, because forging requires the device's private key.

There is a second benefit beyond confidentiality. Signing each request with a device-bound key gives the server a hard binding between a session and a specific enrolled device, which a stolen bearer token alone cannot provide.

Key Points:

• Defence in depth — assume TLS interception is possible, not impossible.
• Ciphertext stays encrypted in server-side logs and crash reports.
• Device-bound signatures resist token replay from a different device.
• The cost is real: key rotation, versioning, and much harder debugging of live traffic.