Well this is what the TPM is supposed to solve. You want to trust the developer (after all if your client app is compromised, end-to-end encryption won't save you), but you don't want to trust the server, and physical access to the server doesn't get you any access to the data.