The server need not be party to the key that is used to exchange the filenames themselves between the clients. The content can be compressed in blocks before u

The server need not be party to the key that is used to exchange the filenames themselves between the clients. The content can be compressed in blocks before upload; dynamic, anchored block sizes would increase de-dup. The compressed blocks can be individually encrypted with a key derived from the filename and block. There's still plenty of opportunity for whole-file de-dupe there.