Hacker News Reader

You could generate hash on device, send it to server alongside the file, once validated delete hash or create decoding voucher.

This is exactly what they are doing right now. Decoding voucher applies when their system thinks that too many hashes goes into CSAM category.