That's a good start. I forgot to add though, to actually make group membership private for real-world practical purposes, you have to achieve all of the followi

That's a good start. I forgot to add though, to actually make group membership private for real-world practical purposes, you have to achieve all of the following: 1. group crypto can't give away the identities 2. your identity system can't give away the actual people 3. your distribution system can't give away the locations of those people It's a hard problem, nobody in the world has done it yet. Signal seem now to have some concrete thing for (1), by your link they are supposedly working on (2), but (3) is also needed.