Edit: After looking around, the following sounds very much like Bitmessage. Which doesn't work precisely like this, and I worry about how it'll scale if the messages get sent to everyone - how does that work with significant throughput? But in any cause sounds like a fairly well thought out system.
==================
So, what would it take to trust an email provider? What'd that look like?
All encryption done on your machine from code you compiled, or at least can compile. Open sourced, so it can be checked. Keys always in your control.
The email should be split into several parts and then onion routed, with associated encryption, to another service with semi-random timing in the forwarding protocol to disrupt traffic analysis.
This service then removes the final layers of encryption, reassembles the message and forwards it to the final destination. Preferably this last step/service is done on a semi-random basis within the forwarding network rather than with a centralised server. Each person serving as a forwarder and a sender would help to confuse traffic analysis when coupled with the semi-random forwarding as well.
I might be wrong, however, I'm guessing that this isn't going to look like that.
Otherwise, it seems to me, you're putting a lot of trust in the server. Even if they pass you some fancy script that does the encryption on your end and there's some way to check that it hasn't changed between visits. Even assuming they don't send you malware. They're still going to be able to see who you're sending stuff to. (And neither of those previous assumptions is non-controversial to begin with.)
==================
So, what would it take to trust an email provider? What'd that look like?
All encryption done on your machine from code you compiled, or at least can compile. Open sourced, so it can be checked. Keys always in your control.
The email should be split into several parts and then onion routed, with associated encryption, to another service with semi-random timing in the forwarding protocol to disrupt traffic analysis.
This service then removes the final layers of encryption, reassembles the message and forwards it to the final destination. Preferably this last step/service is done on a semi-random basis within the forwarding network rather than with a centralised server. Each person serving as a forwarder and a sender would help to confuse traffic analysis when coupled with the semi-random forwarding as well.
I might be wrong, however, I'm guessing that this isn't going to look like that.
Otherwise, it seems to me, you're putting a lot of trust in the server. Even if they pass you some fancy script that does the encryption on your end and there's some way to check that it hasn't changed between visits. Even assuming they don't send you malware. They're still going to be able to see who you're sending stuff to. (And neither of those previous assumptions is non-controversial to begin with.)