Turns out if you want privacy you must either run sth yourself, pay or trust someone not logging. No protocol spec can circumvent the economics of this situation.