I'm at Defcon and was able to catch this talk. Someone asked this exact question after the talk—how can you deal with spam if you you can't scan encrypted messages for trigger words on the server. I'll try to explain what I remember: Ladar mentioned that DIME heavily encourages the use of DNSSEC, so you can verify the sender is definitely coming from the domain they're representing which should reduce spam. He also said everything we're currently doing on the server-side like keyword scanning can be done on the client side. Pretty sure he also acknowledged that it's a nontrivial problem and that the team is still investigating.