You allow the user's machine to obtain a valid certificate for a subdomain of lynk.sh? (This would seem to me the only way to accomplish E2EE, given the example of connecting over TLS to a lynk.sh host, and it also seems very unlikely.)