Re: key distribution, we're just changing it now but in a few days the scheme will be:

1. a community member sends you an invite link containing some onion addresses of community members

2. you sync community data and send a CSR to the community owner.

3. We show an "unregistered" message next to your name until the community owner signs your CSR, at which point you're a full member.

We use PKI.js for the certs. For multi-party message-layer encryption with multi-device support we plan on using: https://github.com/local-first-web/auth, which is inspired by Keybase and a Martin Kleppmann paper.