The bus was public only so a new machine could enrol before it had a tunnel. The machine now makes its tunnel key first, the token is issued for it and makes it a peer of the hub, and enrolment happens over the tunnel.
jschoubben