Even better, why not have a single symmetric group key that everyone uses to communicate? Assume the delivery service is perfect, so you never get dropped messages, and everyone ratchets the group key forward, thus providing perfect forward secrecy.

A question: if someone leaves the group, how do you determine the new group key?

If there is some one-way function f that determines the new group key, then the removed person can derive the new key K' = f(K), where K is the current key. That means that if they get ahold of the transcript of the group after they leave, they can decrypt everything.

So K' must be derived by some non-deterministic process. There's a group of people who need to arrive at the same value, and they need to use randomness. Whose randomness do they use? A simple answer is "the remover." That is, have the remover include a randomly generated K' in their Remove message to the rest of the group. This doesn't work though, because the removed person can still decrypt the Remove message and get K' just like everyone else.

A viable solution is to randomly generate K' and then encrypt it for everyone _except_ the removed party. But once you're here, you run into the problem of pairwise keys, and your runtime sucks.

This last step is basically where the article starts. Thank you for asking this question!