But the user IS already using your protocol.
Your problem is that your server’s interface of what the user can do is not secure!
You decide what data your server sends out to whom!
(Hello, dear online newspapers. Yes, I’m looking at you!)
Design it, assuming that the user is the client. Not your code. Because he is. It should not matter what client is used.
Your app runs on a CPU that is under hardware control of the user. Your code is just a list of commmands/data, and the user and his CPU can process it however they please. Including not processing it.
He decides what his CPU does. Don’t mistake his grace of accepting your app code as-is for a right to blind execution. You’re the one who’s trusted here, and that trust is very fleeting.
Especially with sleazy tactics like this.
In any case: You hand the user the encryption key and everything, and expect him to not use it himself, because you put it somewhere in your basket of code. … Just like DRM, that’s snake oil and can never work.
It takes only one person to find where you put the key. (That would be me, for example.) Everyone else just has to google for it.
But I’m surprised that you only think about encrypting the protocol against the user, instead of for his protection from man-in-the-middle attacks.
Assuming the reason this is usually done (Yes, I’m talking to you “content industry” again.): If your user is your enemy, maybe you should look for a business model that is based on fairness and a win-win, instead of ripping the user off and having to deal with backlash.
P.S.: Ignore all the “security through obscurity” answers. This is a fallacy that results in correct behavior but is still based on invalid assumptions. Using it as an argument, is, at best, amateurish and not really competent.
In reality, all security is through obscurity. Some is just more obscure (= better disguised). The actual reason this is bad, is because what we call real security is a bazillion times more obscure, giving it an actual (statistical) trustworthily high obscurity, as opposed to very simple obscurity that is just waay too likely for someone to come up with from nothing.