10. The non-transitory machine-readable media of claim 8 wherein the method further comprises sending the first public key to the search service to encrypt the search results in a format that cannot be decrypted by the search return process and sending the second public key to the search return process to provide the search results in the third encrypted format.
11. The non-transitory machine-readable media of claim 10 wherein the method further comprises, recognizing the third encrypted format of the search results as a dual encrypted format that includes the encrypted format used by the search service using the first public key, which is not known to the search return process, and includes the third encrypted format that uses the second public key, which is not know to the search service.