> If someone has control of the application, aren't all bets off at that point?

Great point, but not necessarily. This is what we are trying to solve with Redact. Would be interested to hear your thoughts on our solution: https://redact.ws