Cloudflare has the CSAM Scanning Tool for all accounts, not sure how well it works.

https://blog.cloudflare.com/the-csam-scanning-tool/

PhotoDNA, but it requires a suite of lawyers since the material it uses to fingerprint is high res enough to make it identifiable again. Or create false positives.

The article describes schemes where perpetrators share images via file hosting services by encrypting and sharing symmetric keys out of band. There is no way you can possibly identify the file content if they're doing that. The only way is for law enforcement to discover the nature of the photos by other means and then tell you which files are actually CSAM, which works perfectly well until somebody they haven't caught yet who still has local copies uploads again from a different Tor entrance using a different encryption key.

Hosting encrypted zips en masse would also seem to be slightly shady? Sure, there are legitimate uses for that. But if it’s 90% of what your customers share on your platform, you might want to consider that it’s also legal not to host that type of file.

Most of those file sharing platforms get a lot of business from copyright infringers. Keeping files password-protected allows the platform to respond to takedown requests but deal with a minimal number of takedowns. The platform doesn't need to tell its users to do things that way; it's just a natural outcome of incentives. Uploaders don't want their uploads removed. I remember downloading encrypted .rar files to get expensive textbooks even back in the early days of RapidShare. The sites are by their nature pretty sketchy but usually for less heinous reasons than those under discussion here.