The "TeleMessage Archive Server" in the diagram is not the archive. It's a relay that should not have access to the plaintext, but does. And because TeleMessage owns it, they get access too.

The "Archive Destination" is the actual archive and the only thing that should have decryption keys.