If your software encrypts user data with a user owned key that you never touch, i.e. everything is encrypted at rest, can you still be liable if it's later proven to be CSAM?
If you have knowledge of CSAM or reasonably expect CSAM exists in the traffic you're forwarding, you have liability.