Actually, being able to tell anything about a message is incompatible with secure communications. Even the fact that there's a URL in there is more than I want

Actually, being able to tell anything about a message is incompatible with secure communications. Even the fact that there's a URL in there is more than I want you to know. It's all it would have taken to get shot in Iran in 2009. There's a good way to do this though - give the users a local URL classifier and push updates to it. Then the client software is free to block dangerous URLs by default without hurting anyone's privacy. This works, and is used by many AV companies. In fact, because of the way the system is centralized they could be sure the updates would reach users before another message did - providing the same level of safety as scanning the users' messages for them.