[PolCPP]

You could generate hash on device, send it to server alongside the file, once validated delete hash or create decoding voucher.

[nicce]

This is exactly what they are doing right now. Decoding voucher applies when their system thinks that too many hashes goes into CSAM category.