Fair, but he’s the most prominent person here who’s been on both sides of this so I’d genuinely like his take.

Two concrete questions. Did Fly challenge this request, or just comply? And does he still think server-side trust is a non-issue when the identity in this case was built entirely from provider-side records (signup IP, SSH audit logs, a Stripe fingerprint)?

When I said in 2023 that the infrastructure around E2EE matters, he called it misinformation (rather aggressively).

This case looks a lot like the infrastructure mattering.