Don't roll your own crypto.

Leverage the contributions of others to open source protocols and implementations.

This is one of the main reasons why @White Noise and Marmot uses MLS. A small army of giga brains has been working on this protocol for close to a decade, and the continued progress is amazing.

Here are some recent MLS related docs that are going to be discussed at the next IETF meeting. These are all super hard problems, and we get them solved for free.

- Partial MLS (scales groups into the millions of devices, but removes authentication by non-admins) https://datatracker.ietf.org/doc/draft-ietf-mls-partial/
- Leaf Operation Intents (a way for any member to signal that they want to leave a group without having up-to-date state:) https://datatracker.ietf.org/doc/draft-kohbrok-mls-leaf-operation-intents/
- Virtual Clients (a way for several clients to operate as a single leaf node in the tree - could offer big efficiency & privacy benefits with multi-device/multi-client): https://datatracker.ietf.org/doc/draft-kohbrok-mls-virtual-clients/
- Single Signature KeyPackages (makes KPs a bit more efficient): https://datatracker.ietf.org/doc/draft-kohbrok-mls-single-signature-keypackages/
- Amortized PQ combiner (a way to begin introducing post-quantum protections without the huge overhead of real PQ): https://datatracker.ietf.org/doc/draft-ietf-mls-combiner/
- Targeted messages (Sending messages to a subset of a group but not the whole group): https://datatracker.ietf.org/doc/draft-robert-mls-targeted-messages/
- PQ Ciphersuites (fully PQ protected ciphersuites, with very large signatures and keys): https://datatracker.ietf.org/doc/draft-ietf-mls-pq-ciphersuites/
- DMLS (Distributed MLS - a sort of convoluted/complex way of allowing multiple different commits for a given epoch - probably not that useful but would solve for someone being offline, making changes to a group locally, then having to sync up later with the rest of the group): https://datatracker.ietf.org/doc/draft-xue-distributed-mls/