For me, it's not about shifting data out of naivety that companies/users aren't being spied on everywhere. Instead it's about shifting data into a legal domain

For me, it's not about shifting data out of naivety that companies/users aren't being spied on everywhere. Instead it's about shifting data into a legal domain in which you hope to hold someone to account for intrusive spying. A non-US entity has zero chance of ever holding the government and agencies of the USA to account. And we're also aware that US companies can be forced by the US government or agencies to access data held (by them) overseas. But we do have some chance (fractionally above zero, I'm not deluding myself) of holding our own governments and companies within our legal domain to account. None of it is a substitute to encryption, but this isn't solved through tech alone.