How the codec protects the envelope. signed (HMAC-SHA256) gives integrity and authenticity but leaves the inner state readable on the wire; encrypted (AES-256-GCM) additionally gives confidentiality.
HMAC-SHA256 over the payload. Tamper-evident, not confidential.
AES-256-GCM over the payload. Tamper-evident and confidential.
How the codec protects the envelope. signed (HMAC-SHA256) gives integrity and authenticity but leaves the inner state readable on the wire; encrypted (AES-256-GCM) additionally gives confidentiality.