that the functionality it contains can [...] before the functionality is activated [...] an encrypted tunnel