[throwaway67114]

// Let's say a user encrypts a file outside of Dropbox, using a program of the user's choice, then she transfers the encrypted blob to Dropbox //

Most people won't encrypt before transfer to Dropbox.

Even if they do, all security usually relies on a password set by the user. Normal users are known to set easy to crack passwords.

So two unusual things need to happen for things to be secure.

The security of Magic Wormhole doesn't rely on the relay server, as explained elsewhere in this thread.