The question behind the term
“Secure messenger” is not a testable property. A useful model separates message content, account identity, membership, routing metadata, key recovery, calls and device compromise. Each asset has different readers and failure modes.
A reviewable approach
Start with a conversation-type matrix. For every direct chat, group and channel, record where plaintext exists, which device or service holds keys, how a new device joins and which metadata is needed for delivery. Put the answer into the interface before the user sends.
- List assets before cryptographic primitives
- Show protection by conversation type
- Design key loss and identity change states
- Publish server-visible metadata
The boundary to keep visible
Client-side encryption cannot protect a compromised endpoint, and it does not automatically hide participants, timestamps or delivery state. Livara Chat applies E2EE to direct messages and compatible private groups; channel content stays server-readable, and routing, membership and timing metadata remain a separate boundary.