#E2EE must be explicitly protected, and client-side scanning must be excluded entirely.