I guess it's possible the machine (connected to the Internet) pulling from Amazon is also connected to a network with the machine that can decrypt (but can't access the Internet)