We could generate public URLs that contain the decryption key of the album within the URL fragment. But as an encrypted storage provider, we would like to ship this only after we're reasonably confident that there are checks in place to prevent abuse.