Lets say Alice@gmail.com wants to send message to Bob@secureMail.com
Alice <--> gmail.com <--> secureMail.com <--> Bob
We know gmail.com can read the unencrypted message. Is it possible for secureMail.com to receive the message such that only Bob can decrypt the message?
If my understanding is correct, secureMail.com will have a ssl certificate and gmail.com will encrypt using secureMail's public key so that the communication is secure. So secureMail.com can read unencrypted message. It can however re-encrypt with Bob's public key before persisting on disk.
Does email protocol allow secureMail.com to present different certificate/publicKey for each user to gmail.com so that it never gets to read unencrypted message?
Update:
This website claims emails are end to end encrypted and even the server cannot access decrypted data. Did i miss something? site: https://protonmail.ch/
https://protonmail.ch/pages/security-details
ProtonMail's segregated authentication and decryption system means logging into a ProtonMail account that requires two passwords. The first password is used to authenticate the user and retrieve the correct account. After that, encrypted data is sent to the user. The second password is a decryption password which is never sent to us. It is used to decrypt data on your device so we do not have access to the decrypted data, or the decryption password. For this reason, we are also unable to do password recovery. If you forget your decryption password, we cannot recover your data.