If you _do_ "consider it", I hope you discard it as an awful idea pretty much immediately. I'd suggest allowing customers who're concerned to run their own ins

If you _do_ "consider it", I hope you discard it as an awful idea pretty much immediately. I'd suggest allowing customers who're concerned to run their own instances with your code on it (perhaps a Docker image?) - but giving random customers shell access to gateways you're responsible for (at least to Amazon) - would be insane... Signal/WhisperSystems are doing some interesting work on how to prove the code running on their servers is identical to their published and auditable code - might be worth checking that out (for a post MVP roadmap idea).