Fair point and that's what 0.17 changed: a personal watcher runs on your own machine, so the view key never leaves you and since 0.18 amounts stay private too. The tx-proof route is interesting: no view key at all. The blocker is wallets: none hands txid + tx key back to the app yet, so senders would copy them by hand. If wallets add a callback URI, I'd gladly support it.