This is why one should always, always use client-side encryption. Want to encrypt to the server? Sure, fine, there are good reasons for that interaction to be

This is why one should always, always use client-side encryption. Want to encrypt to the server? Sure, fine, there are good reasons for that interaction to be encrypted. But there are good reasons for one's data to be secured from the server as well. Any protocol in which a malicious server can do more than deny service is broken.