The system hosting the model must be one of the ends.

Remember, all encryption is E2EE if you're not picky about the ends.