We should make a distinction between the server tampering with message content and message metadata. Message content is protected by well-scrutinized and audit

We should make a distinction between the server tampering with message content and message metadata. Message content is protected by well-scrutinized and auditable client code. However, there's nothing stopping a malicious server from logging a bunch of extra metadata on top of what they claim to log, which would be very interesting for nation states. And the extra-metadata scenario is the one being criticized, I think. If you trust Intel SGX (or other secure enclaves) it is theoretically possible for the server to attest to the client that a particular hash of code is running. (Typically the reverse process is used, to attest to a server that a client is running whatever DRM code the company wants.) Signal already uses SGX to implement contact search [1]. The actual algorithm is performed in plaintext in the enclave. Now, you might counter that SGX is full of holes, and I would agree with you. [1]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/