I work at Signal and wrote much of that code, so I'm familiar with it :).
Yes, it uses a server for media distribution and uses encryption keys that the server does not know.
Yes, it uses a server for media distribution and uses encryption keys that the server does not know.
Do you rotate the group key regularly and/or on group events (e.g. a person leaving the group call)?
What SFU do you use, and did it require custom modifications? Or is it even a fully custom server-side solution?
I don't think we've made the SFU repository public yet, so I don't think I can comment on that yet. Likely I'll be able to in the future.