Hey mate, it just so happens that I’m working on a very similar thing. Maybe I could help you out regarding security and local-first stuff? Drop me an email if you’re interested. Cheers.
EDIT: In any case, you could take a look at https://github.com/YousefED/Matrix-CRDT. Matrix takes care of e2ee. CRDTs give you local-first super powers.