Since everything is unsigned anyway the client can inject extra tags in the event after decrypting and before storing it for that purpose, no? Is that what you mean?