If files sent to Mega is encrypted client-side, how exactly would files be shared without the key being sent through Mega's servers at some point? Does Mega provide some sort of API to allow for an application to share the key?
I am not a user of Mega, but from what they write in their Help Centre ("Sharing") under "How does folder sharing work?"
... it would appear that that they are implying that the key exchange does not involve their servers all.
Of course, in the end, as they themselves write in their Help Centre ("Security and Privacy") under "What if I don't trust you? Is it still safe for me to use MEGA?", it all boils down to whether or not you trust them. And with proprietary closed-source solutions such as these, there will always be uncertainty inherently built into the system.