"you have to trust the client-side code, which is an insurmountable problem" That depends on what you're trying to achieve, who you're willing to trust, and wh

"you have to trust the client-side code, which is an insurmountable problem" That depends on what you're trying to achieve, who you're willing to trust, and what you're willing to do. If your goal is to do searches without having to trust client-side code from a search engine or Private.SH, then you could (assuming they have support for such a workflow) do your own encryption using a tool you do trust, such as gpg, then submit the encrypted query to Private.SH, which would hand it off to the search engine. The search engine could then decrypt it, perform the query, and re-encrypt it to your public key (which would be contained in the encrypted query they got) and pass it back to Private.SH, which would then pass the encrypted query back to the user. This way no code from Private.SH nor the search engine has to be trusted. Of course, this does not help if Private.SH is secretly owned by, compromised by, or has a data-sharing agreement with some entity you don't want your data to be seen by (such as the search engine, hostile agency, data harvesting/reselling organization, etc). This latter possibility is what I really don't see an easy way to mitigate. For all we know any/all of these "privacy respecting" services might be owned by Google, Palantir, some other data harvesting corporation, government agency, intelligence service, etc.