> Would allowing organizations to manage their own key(s) suffice?
No. Slack does not implement searching logic on the client. If the key is only known to the client, and the search logic is only known to the server, you can't search anything.
End-to-end encryption is fundamentally incompatible with server-side search, because it mandates that the secret key can never leave the client. You can't reconcile these two features without efficient homomorphic encryption (which does not exist yet, and will not exist for the foreseeable future in any practical sense).
It could be compatible with hosted server-side search, no? (Requiring a certain amount of trust that it doesn't phone home, but that's true for a search-less encrypted client as well.)
The move to 3rd party hosting for super-sensitive internal stuff like this baffles me.
Yes, that would be fine and is fully realizable. In the client-server model of end-to-end encryption, a server self-hosted by the user is isomorphic with a user's client. They're effectively the same thing.
The tricky part here is defining who the user is. If you're implementing end-to-end encryption for data on a per-employee basis, you're back to square one with a self-hosted server. But if you're implementing end-to-end encryption for data on a per-organization basis, and the organization has a self-hosted instance it controls, then yes, end-to-end encryption is compatible with organization-wide message search.
Could work for limited search. For example each term in search index encrypted by the company key. Client passes is also encrypted search term.
Actual content of the messages could be encrypted separately. Client would send separately the selected terms for indexing and the content for each message.
No. Slack does not implement searching logic on the client. If the key is only known to the client, and the search logic is only known to the server, you can't search anything.
End-to-end encryption is fundamentally incompatible with server-side search, because it mandates that the secret key can never leave the client. You can't reconcile these two features without efficient homomorphic encryption (which does not exist yet, and will not exist for the foreseeable future in any practical sense).