A downlink single-input single-output (SISO) non-orthogonal multiple access (NOMA) system in which a base station (BS) is communicating with two users is considered. An untrusted half-duplex relay node is available to assist with the BS's transmission. The BS uses superposition coding to transmit its messages, and the relay employs either a compress-and-forward or an amplify-and-forward scheme to communicate with the users. Two modes of operation are considered: passive user mode, and active user mode. In the passive user mode, the users receive data from both a direct link from the BS and the relay's forwarding link, and use that to decode their messages. In the active user mode, the users send a cooperative jamming signal simultaneously with the BS's transmission to confuse the relay. The focus is on half-duplex nodes, and hence the users cannot receive data from the BS's direct link in the active user mode while transmitting the cooperative jamming signal; they receive it only through the relay's forwarding link. For each mode, and under each relaying scheme, achievable secrecy rate regions are developed. Results show that the best relaying scheme and user mode depend on relative distances among the nodes, and on which part of the secrecy region the system is operating at.