I think the question is, if a group of users create a new cap, and use it, can other people who are not privy to that cap monitor network traffic and get it? My understanding is the cap isn't used in the signing of the log. So you could have a network which rotated the cap every month or even every day?