Theoretically yes, but for that the end user would have to get his private key stolen by someone with undetected server access or someone would have to break th

Theoretically yes, but for that the end user would have to get his private key stolen by someone with undetected server access or someone would have to break the XSalsa20 cipher.