You can't. That's why trust comes into play. Even if you can design such a system, you must still trust the implementer to get it right, and in the case of emai

You can't. That's why trust comes into play. Even if you can design such a system, you must still trust the implementer to get it right, and in the case of email, trust the receiver not to do anything stupid with the cleartext.