The solution doesn't have to protect against intercept-in-transit.

For example, suppose that this was implemented on a VPS on some random hosting provider, and I own all of the code on the VPS. The hosting provider could record all email traffic coming into that box, but that problem isn't in scope (and could be addressed with, say, openPGP).