edit: To be clear, we no longer nag whenever there's an unverified login present - and unverified logins should increasingly be a thing of the past anyway given we now have cross-signing and so let users verify their own sessions at login.
Only my closest family would listen me explaining that there's encryption but there's also authentication, yet only because I force that info upon them while standing over their shoulder, making sure they write down all the recovery keys.
Select few graduated to password managers and know to back the bases up.
It's a struggle, mainly because I'm the only one who cares in this particular social circle, and thus people don't see my concerns as normal.
However, the feedback is overwhelmingly that we need to iterate on the recovery passphrase - either making it a generated key (like macOS does), or going the whole hog and replacing the login password entirely with the cryptographic recovery one.
Turns out the UX on this stuff is tough.
There is an open issue on this topic[1].
edit: also, congratulations, really hope matrix can get the market share it deserves
BTW: I absolutely love the cross-signing move and riot/matrix in general! :) Thanks for your great work on this!
It's possible we'll reintroduce this once cross-signing has been fully adopted though; it's tricky because we need to distinguish between encrypted rooms where you simply don't care if random users have unverified slides... versus ones where it's a disaster if an unverified session slides in. Finding the right UX for that is tough, but we think the current balance is an improvement.
That is really a tough UX problem... Maybe a room could have a "sensitive content" flag that is enabled by default for one-on-one chats and can be manually enabled for group chats.
Nice to see this finally happen :-)