Comment by windsurfer

Are you sure? According to this: https://wiki.mozilla.org/Labs/Weave/Sync/1.1/Setup it says the passphrase you use is sent in the clear (over HTTPS) to mozilla every time you get the data. That implies that while the data may be stored encrypted client-side, it's decrypted or at least verified server-side.