If your software encrypts user data with a user owned key that you never touch, i.e. everything is encrypted at rest, can you still be liable if it's later proven to be CSAM?