See, this is the one complicating factor for L7 E2E, and I think you make a compelling case; you pretty much need open source/reproducible builds to be able to

See, this is the one complicating factor for L7 E2E, and I think you make a compelling case; you pretty much need open source/reproducible builds to be able to have any kind of protection against leaking PIIs over encrypted channels. I think the best one can do today with services like Facebook/Instagram is to use third-party clients, or, in lack of that, the web apps. IMO DoH/DoT is the main venue where this tradeoff becomes obvious today; privacy with regards to infrastructure providers, or ability for the user to see/control what your software reaches out to?