Devices and techniques for secure transmission of content over third-party networks are provided. Keys are established for secure transport of content between a source and recipient via a third party. The source generates a content package that includes an encrypted payload, and a payload handler. In some instances, the content package may also include user interface code for obtaining a secret from the recipient. The content package may be signed (e.g., the message content hashed and the result of the hash added to the content package). The content package is transmitted over a connection to a content delivery service for delivery to recipient(s) via another connection. The content delivery service receives the package and forwards the package to recipient(s) without decrypting the payload. A recipient receives the package from the content delivery service, validates the package and decrypts the payload. The payload may be presented to a display application.