How can one be sure that the relay does not record all the data flowing through it? There's not a second independent channel where the key is exchanged between sender and receiver.