Even if we solve this problem by getting the users permission, or using signatures instead of a URL that points off site, or with a proxy (transparent/hosting a

Even if we solve this problem by getting the users permission, or using signatures instead of a URL that points off site, or with a proxy (transparent/hosting at server/tor) then what is the next complaint? Do we trust the server we're connecting to with their own TLS certificate revocation status? DNS? What about all hops along my network path? Email headers? I doubt this was the intent. Using the Internet is inherently public. Privacy is hard and needs a clear separation / promise to the user. With that, Governments should have an awareness campaign so people know when they visit their bank website that they may be accessing third parties for fonts and tracking and that only their financial information is private.