I need to tear into this later, but I really hope they're not implementing multi-party ECDH (which is perilous even if you're using X25519; if anyone thinks about going down this route, please hire a cryptographer).
https://whispersystems.org/docs/specifications/doubleratchet...
Alice, Bob, and Charlie are chatting securely. Using the notation where lowercase indicates secret key and uppercase indicates public keys:
s0 = aBC = bAC = cAB
s1 = aBCD = bACD = cABD = dABC
Now they decide to oust Charlie from the group. How do you handle revocation safely and efficiently?
If you combine the two issues above, you create a join-slurp-leave loop that gives you the secret keys of conversations that take place while you are absent. (This is an active attack, of course.)
Let's say Bob's laptop is stolen. Does mpECDH have forward security-baked in? No. (Protocols like Signal's do.)
So you add forward secrecy. Great, now how do you know the server isn't replacing public keys since they're changing frequently?
These are just a sample of the kind of challenges one faces when they venture down this road. If you ask almost any cryptographer, they'll have a somewhat reasonable answer for these challenges. But a non-crypto dev would, with all likelihood, not think to even ask.