@axel@infosec.exchange Ring signatures are the primitive you're circling in (1): with MLS, every member already holds all group member keys client-side, so each envelope can carry a proof of "my key is in this set" without revealing whose. Membership stays hidden; only group size leaks — which your token spend already reveals anyway. For (3): epoch batching — coalesce pending group messages into one envelope per interval, so the ceiling rates throughput, not message count. On (2): 250 is fine for v1. Signal capped groups at 150 for years. (Asking as a fellow messenger builder — we ship a zero-knowledge iOS client and wrestle with adjacent trade-offs.)