JMAP (or IMAP for that matter) is the transport format. JMAP runs over HTTPS, so the connection is encrypted. The transport protocol says nothing about how data

JMAP (or IMAP for that matter) is the transport format. JMAP runs over HTTPS, so the connection is encrypted. The transport protocol says nothing about how data is stored on the MDA (the server). That's up to the implementation of the MDA, of which no standard exist. The MDA is something that you should trust, if you cannot trust the MDA, you shouldn't use it in the first place. What you need to worry about it transport, and that has been fixed by mandating HTTPS.