[Lammy]

That's a total red herring. They see the metadata (data about data) of every connection you make. They don't need to capture any encrypted data to tell a whole heck of a lot about you: https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

[SvenL]

Exactly, also, as long as there is no way of verifying that the source they opened up is the one they are running, it’s still a trust thing.