This relay gives GurtOS boxes an address like rosa.box.gurtos.com. It passes each connection to the box by name,
still encrypted: the box holds its own certificate and key, so the relay cannot read what goes through.
It also forwards push notifications to phones. The box encrypts each one for the phone before it gets here.