Comment by dheera

Fine with me too. I think many other apps (WhatsApp, FB, etc.) are using E2EE for PR purposes and are not actually good implementations of E2EE.

Good implementations of E2EE:

1. Generate the key pairs on device, and the private key is never seen by the server nor accessible via any server push triggered code.

2. If an encrypted form of the private key is sent to the server for convenience, it needs to be encrypted with a password with enough bits of entropy to prevent people who have access to the server from being able to brute force decode it.

3. Have an open-source implementation of the client app facilitating verifiability of (1) and (2)

4. Permit the users to self-compile and use the open-source implementation

If company isn't willing to do this, I'd rather they not call it E2EE and dupe the public into thinking they're safe from bad actors.