But you can't write a reply block without knowing the payload!

Since the author of the reply block can't guess the right hashes for the payload, we've reintroduced the payload tagging attack.

Actually, that's ok. Since we're encrypting at each hop, only the recipient can recognize the tag.