This could be alleviated if the server kept the user's key only on a per-session basis and never actually stored it. I'm curious... how would you feel about tha

This could be alleviated if the server kept the user's key only on a per-session basis and never actually stored it. I'm curious... how would you feel about that? Also, there might be a way to make a server transparent so people are more likely to trust it... open-source the server code, of course, and expose the entire file system as read-only could people could run a checksum on the server executable to verify it's the same one? Of course there'd ultimately be no guarantee that there wasn't networking trickery going on...