This illustrates why I'm so skeptical of all these "end to end encrypted" closed source solutions like WhatsApp: yes, they're end to end encrypted so the server doesn't necessarily get to see what's going on, but what's the point in that when I can't trust the client?