CONSILIUM BELLI — MESHTASTIC SAFE DEFAULTS (review + apply)
===========================================================
Civilian, observation-and-reporting only. NZ ISM (915 MHz) is where
encryption is legal; keep encryption OFF amateur/HF bands. Cap TX power
to the GURL limit before transmitting. comms-harden.sh applies all of this.

WHY IT MATTERS
  The stock Meshtastic primary channel uses a PUBLIC key (AQ==). Out of the
  box your direct messages are effectively unencrypted. Fixing that, and
  turning off the broadcasts that leak your position, is 90% of the win.

EVERY NODE (handset AND relay)
  [ ] Firmware >= 2.5 (enables per-node X25519 PKC direct messages)
  [ ] position.position_broadcast_secs         = 0      (no position broadcast)
  [ ] position.position_broadcast_smart_enabled = false
  [ ] pos-fields                               = (none) (broadcast no position)
  [ ] telemetry.device_update_interval         = 0      (no device telemetry)
  [ ] telemetry.environment_update_interval    = 0      (no env telemetry)
  [ ] Full-disk encryption + a wipe/kill path on the device

OPERATOR HANDSET (holds the private channel key)
  [ ] Primary channel name                     = Ops
  [ ] Primary channel PSK                       = base64: <real 256-bit key>   (NOT AQ==)
  [ ] uplink_enabled / downlink_enabled         = false  (don't bridge to the public internet mesh)
  [ ] DMs use PKC automatically (signed + encrypted) on fw >= 2.5

UNATTENDED RELAY / ROUTER (holds NO private key)
  [ ] device.role                              = ROUTER
  [ ] DO NOT load the private channel PSK on this node
        -> it rebroadcasts encrypted packets it cannot read; physical
           capture of the relay yields no key.
  [ ] Tamper-evident enclosure; no secrets at rest

ABOVE MESHTASTIC (Layer 0 — the real confidentiality)
  [ ] End-to-end app crypto (ChaCha20-Poly1305 + X25519, forward secrecy)
        so one compromised node never exposes the whole mesh
  [ ] One-time pad for the command channel (distribute at muster, use once, destroy)

ONGOING DISCIPLINE
  [ ] Rotate the PSK on a schedule and after any suspected loss
        (assume record-now, decrypt-later)
  [ ] Lowest TX power that closes the link; directional antennas; burst timing
  [ ] Keep the net small; assume traffic analysis reveals who/when

LEGAL (NZ)
  ISM 915 MHz  : General User Licence, no callsign, encryption ALLOWED, cap power
  Amateur HF   : authenticate yes, ENCRYPT NO — plaintext + brevity only
  Confidential long-haul : licensed commercial HF or satellite, never amateur