Unless a site is hosted on the site owner's physical hardware, some third party is being trusted this way. A shared hosting provider could dump the server traff

Unless a site is hosted on the site owner's physical hardware, some third party is being trusted this way. A shared hosting provider could dump the server traffic, a VM provider could extract TLS session keys from the guest's memory.