I mean e2e as far as the connection is concerned, whether it's a server talking to end-users via HTTPS, or a server in a datacenter in Singapore talking to a se

I mean e2e as far as the connection is concerned, whether it's a server talking to end-users via HTTPS, or a server in a datacenter in Singapore talking to a server in a datacenter in Atlanta using GPG or TLS or whichever proprietary encryption algorithm you want to use. If China / HKG has that subpoena power for arbitrary SSL certificates, then we've already lost. As I mentioned, significant traffic already transits through HKG. But even so, what enforcement mechanism does China have? Facebook as well as many other services are already blocked... And honestly, if China starts using subpoena power to take control of SSL certs, that's a _very_ strong incentive to leave that market entirely, as not only can they decrypt your traffic; they can also impersonate you. "True e2e" as offered by Signal / Telecom still relies on Diffie-Hellman key exchange, and therefore some notion of public / private keys with custom PKI servers. It's no different from an attacker's perspective -- instead of the global PKI infra underpinning the web, you're just dealing with a single entity. Compromise the PKI, and you can MitM to your heart's content.