Encrypted relays and clients.

Storage is never unencrypted, neither npubs nor their content. Transmissions are always encrypted with the recipients npub, and requests are made encrypted with the relays public key. Decrypt-encrypt always happens in one step, so decrypted content is never even sitting in memory where it might go to swap. Booting the system up requires a key that is never stored but only sits in memory until system shutdown, so I've the machine gets compromised or confiscated it can't divulge anything.

I bet a device exists to decrypt content off-system, so the system with the database doesn't have the capability to decrypt on its own with even a temporarily stored key.