Here is the promise the whole system is built to keep:
The security invariant
An attacker who completely owns the server can stop it working and can see who is talking to it. They cannot read a secret, cannot forge one, and cannot leave themselves a way back in.
How that is achieved, in plain terms:
Nothing decryptable is on the server. Encryption happens on your machine before anything is sent. The server stores encrypted files and public keys. There is no moment, even briefly, when plaintext exists on it.
You prove who you are by signing, not by presenting. The server sends a random challenge; you sign it. The server keeps only public keys, so stealing its entire database yields nothing usable.
The server is not in charge of anything. Who is a member, who was granted what, which version is current: all of it is signed by people and checked by your own machine against a trusted starting point. The server just carries messages it cannot alter.
There is nowhere to hide. No database, nothing writable, no plugins, no dynamic configuration, no self-update. It is redeployed from scratch on a schedule, so an intruder is evicted by the next deploy.
What the promise does not cover: an attacker on the server can still break things (refuse to serve, go offline, slow you down) and can see which secrets you ask for and when. Denial of service and metadata sit outside it.