Google recently introduced the client-side encryption functionality in several services of Google Workspace (see https://support.google.com/a/answer/10741897?hl=en).
The purpose of client-side encryption is to encrypt data on the user side, before transmission to the server (such a a cloud service), and without transmitting the encryption key to the server. Hence the server cannot access the decryption key, and decrypt the data.
Nevertheless, the server (here Google) provides the encryption/decryption methods to the client (via the browser in the case of Workspace). We must therefore trust Google to implement these functions as expected (i.e. using state of the art encryption algo, resistant to cryptanalysis by the US authorities, etc.). In particular, there should be a guarantee of the absence of backdoors in these methods that may leak the key while encrypting/decrypting and a guarantee that Google cannot be forced by the US authorities to introduce them.
An alternative would be that the encryption/decryption methods are open source and auditable.
Do I get it wrong or the client-side encryption provided by Google does not guarantee the absence of access of the cryptographic keys by Google?