[nicce]

Unfortunately this does not matter, since the trust model is same as it would not be encrypted at all. We still need to trust the third party.

Somehow the infrastructure should be transparent so that outsider can verify indeed at any time, that you don't collect logs from that traffic, or have no other means to inspect traffic if you want to.

There are currently no other means than just to use E2E encryption.

There is also another almost there, but that would mean that you should open-source your whole infrastructure, and use reproducible builds. Somehow there should be way to get access for outsiders, that you indeed use your infrastructure as you describe in your source code. But this is very complicated and also changeable at any time, unlike E2EE.

[amilich]

We use an open-source mailserver (Haraka), but security audits are the most trustworthy way to do this. We've had 4: skiff.com/transparency. Audits cover infrastructure.

[tptacek]

You can't audit a non-E2EE design into E2EE security!