It's kind of like a distributed VPN. The interesting part is the addressing. All you have to do is resolve a machine's name and you get a direct encrypted tunnel to it with automatic NAT traversal and the address assigned to the tunnel endpoint is provided as the name resolution response.