>if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want

yes which is why i hoped they would implement a verification system like with a browser addon that compares the website client code used for encryption and alerts the user if it does not match the one served everyone else.

ctemplar mail used to have this many years ago

https://web.archive.org/web/20200201012958/https://ctemplar....