I did say "fig leaf". But some level of client-side would at least demonstrate good will, or some level of "giving a fsck". There is a real difference though,

I did say "fig leaf". But some level of client-side would at least demonstrate good will, or some level of "giving a fsck". There is a real difference though, which is the difference between code on your client which perhaps you could at least check if you're stubborn enough[1], and plaintext in a datacenter. This can mean the difference between targeted surveillance and mass surveillance. Dropbox is a separate case - it was always "trust us" (we have your keys) encryption, and not what I would refer to as "client side" at all. [1] This is a hard problem if you don't trust the OS