[mikepurvis]

The point would be that the index would serve to route "scrambled search term X" to "scrambled record Y", and the degree to which that scheme could protect the privacy of users would be a function of how much redundancy was inserted into the system at various points, all of which could be tunable on the client side (dummy record entries, dummy index entries, dummy queries, whatever).