The client that is sharing the album could append the decryption key of that album to the URL fragment, such that it never reaches the server.

For example: albums.ente.io/{albumID}/!#{decryptionKey}

Now on the receivers side, the client can use this `decryptionKey` to decrypt and render the photos.