We support doing a public key encryption of the file contents before scanning https://github.com/element-hq/matrix-content-scanner-python/blob/main/docs/api.md#encrypted-post-body, but it's quite an annoying faff to do for web clients. Given we already communicate over TLS for this, it seems overkill.