The keys exist only at the endpoints, so a provider compromise or subpoena yields ciphertext. The corollary is that endpoint compromise yields everything, which moves the real attack surface to devices rather than servers.
Coverage boundaries matter: backups, metadata, subject lines, and group-membership records often sit outside the encrypted envelope. The messaging comparison documents where each service draws the line.