I like the approach of mega.nz... Server stores encrypted blobs. Server doesn't have the keys. Entire application is on the client, and just downloads and

I like the approach of mega.nz... Server stores encrypted blobs. Server doesn't have the keys. Entire application is on the client, and just downloads and decrypts what it needs. Obviously your entire application stack needs to be developed with that approach in mind, and some things like 'make a hyperlink to share this' get much more complex.