The provider could still be held liable if the decryption keys became public. The argument would just be that they "should have known better" than to "publish" data that they couldn't examine.