@lcamtuflcamtuf and of course, for most problems the overhead of HE is high enough that if it's computationally prohibitive to do it on the client device, it's going to be computationally prohibitive to do it with HE on the server side.

It does make legitimate use cases for HE a rather rare occurrence. Biomedical research is about all I can come up with, to be honest, where often the analyses to be run are relatively simple, but the data cost many millions of dollars to obtain and the risk of theft is quite high.

And it's the primary threat model for self-documenting cryptography: I designed a variant of PBKDF2 and bcrypt that adversarially embeds an organization's name and contact information into their password hash function, so that in order to crack a hash, you must know where to report it stolen.

I'm attempting to force people who wish to hide that information to use Fully Homomorphic Encryption, and maximize the overhead that those people have to suffer.