  To clarify what is involved in linking models to instruments, we adapt
quantum mechanics to define models that display explicitly the points at which
they can be linked to statistics of results of the use of instruments.
Extending an earlier proof that linking models to instruments takes guesswork,
we show: Any model of cryptographic instruments can be *enveloped*,
nonuniquely, by another model that expresses conditions of instruments that
must be met if the first model is to fit a set of measured outcomes. As a
result, model A of key distribution can be enveloped in various ways to reveal
alternative models that Eve can try to implement, in conflict with model A and
its promise of security. A different enveloping model can help Alice and Bob by
expressing necessities of synchronization that they manipulate to improve their
detection of eavesdropping. Finally we show that models based on pre-quantum
physics are also open to envelopment.
