Let's say I'm talking with two other people: is there a way to do E2E encryption without having to send out the same stream twice?
edit: Just realised a common key would allow this. But I am still interested in schemes for deriving a key amongst multiple parties using a middleman without the middleman knowing the key. It seems like a rather hard problem.
This is exactly what happens when your browser establishes an HTTPS connection. There are many middlemen between you and the web server, but it still manages to negotiate a shared symmetric key (the session key) that can be used for the bulk of the encryption.
The difference is that there is no certificate authority vouching for each participant in a video call's identity, so you would need to do independent identity verification if you want to ensure that the call is secure, which some people would do by reading the public keys of each participant aloud, and people verifying that everything matches what they see.
This is a good point I hadn't considered. It led to me questioning how signal did it "right," and realising that there is seemingly no way around educating users to check public keys.[0]
So if video chats were meaningfully E2E encrypted, we would need a way to verify the public keys, which afaik Zoom doesn't have.
[0] https://web.archive.org/web/20160828135326/https://www.inter...
[0] https://superuser.com/questions/554513/pgp-encrypt-single-me...