I agree. You would be better off, if you have a private key per device and increase your logic on the server side (multiple devices per user), to allow for easi

I agree. You would be better off, if you have a private key per device and increase your logic on the server side (multiple devices per user), to allow for easier revocation of stolen devices. “Linking multiple devices” via their public key is still fine, since the user has to login once with email/password (or by some other means). If you were to have the requirement of needing multiple private keys to decrypt a message, that would be a different thing - maybe to ensure in a group chat only the current group chat members can decrypt the messages. And whenever a member leaves/joined a new group secret gets generated based on all private keys of all members. But then what would be the benefit of this ?