A sensible system would require no trust. You could trust no provider would collude or be hacked ever. But to prevent governments to demand records requires records not exist.