You mentioned that the pfile format would apply if the file left the endpoint.  What if the user transfers a file to an on-prem file share, or SharePoint.  Ideally, we will only want the pfile modification if the file leaves our environment.