A breach of trust would be detectable in client side encryption, but not in server side. An average user wouldn't notice a difference, but a security researcher could. Any high-profile service that systematically tampers their own client-side encryption would very likely be caught.
I use Model Ms, though on my main dev machine I have switched to a Leopold with Cherry MX Blues. I find the actuation force to be more balanced between keys, and a more pleasing curve overall.
True, but it's not a bad idea to check for an @ in the string as a sanity check, in case the user has accidentally put their username/password/other in the field.