Is something wrong with tox? It is a p2p messenger that works on smartphones.
Where did you get that from? Tox uses libsodium. [0]
[0] https://github.com/irungentoo/toxcore/blob/master/docs/updat...
Though, even the issue you've linked show the thought that the tox team have been putting into their protocol. (A stolen private key is game over, as in most situations. KCI is hard, let's rework.)