I was thinking about this a while ago… the loophole I see is that the provider is the one who sets the public/private key of the LLM. And because the LLM is not a person who remembers its password (unless we come up with a way for it), we cannot guarantee that the provider doesn’t use keys to decrypt and read the messages.