I wasn't aware of that, but of course the destination is still leaked via RCPT. If the server is going to provision keys (and presumably thus escrow them), this

I wasn't aware of that, but of course the destination is still leaked via RCPT. If the server is going to provision keys (and presumably thus escrow them), this is strictly less private than using server-to-server encryption.