The same thing goes for knowing that whatever system is ensuring that X and Y receive the same payload hasn't been corrupted.

Actually, that part's easy. The message can only corrupt things which both receive it as input and perform nontrivial computation on it. You don't need an "arbiter" to copy a message, nor do you need to decrpt it.