Question 1: that is correct, the payload is still encrypted. Question 2: this has been discussed before here. I would like to refer you to Pierre's blog here.