One more brainstorm, The provider can serve key escrow and still have the end-user application perform the encryption, which may or may not technically qualify

One more brainstorm, The provider can serve key escrow and still have the end-user application perform the encryption, which may or may not technically qualify. It certainly wouldn't fly without skepticism in a popular service/standard. I haven't looked into it deeply enough to present a confident statement either way.