I always end up with MPL whenever I do these kinds of selection guides and always wonder why it isn't more widely used. Is it because the lgpl covers a lot of the need for it, or because once you allow static linking you might as well go BSD?

Free marketing at the expense of user trust

Actually I'm doing something related to this. So considering e2ee by definition doesn't require the messenger/middleman to co-operate, you can turn any communication medium into an end to end encrypted one. So I made a fully offline, client-side browser extension (it can also be a copy paste console snippet) that hooks into the send button of a POC malicious chat app and performs a key exchange for you. Then it sets up hooks to automatically encrypt messages before sending it, and also decrypt messages you receive.

So visually it looks just like you're chatting normally, but the server gets only encrypted messages.

how can we verify that the server side code they/they will publish is what they are running on their servers?