Of course. That doesn't mean a service can't prove it's secure. The service can be as secure as it wants, if you're talking within earshot of your adversary, you're screwed.