We need to talk about metadata leakage in "zero-knowledge" cloud sync

Zero-knowledge cloud storage is a misnomer if providers still index your metadata unencrypted. I proxied the desktop client traffic of a major "privacy-first" European provider yesterday. While the file payloads are encrypted, the API requests expose the complete directory tree, file sizes, and precise modification timestamps in plaintext.

For anyone with access to the server, this leaks the entire footprint of your archive. They know exactly what kind of data you hold and when you access it.

How are you mitigating this? Is nesting Cryptomator or rclone over raw S3 storage the only logical path to actual privacy?