The first member would create a group, and others can join that group by scanning a QR code. Strictly wanted to avoid any PII such as phone numbers. Need ideas

The first member would create a group, and others can join that group by scanning a QR code. Strictly wanted to avoid any PII such as phone numbers. Need ideas on how to handle things like removing a person from a group (i.e. resetting the shared private key). For encryption, the idea was to keep things simple and have the QR code be the private key so that it's never transmitted. But another option is to use Matrix.org's E2E protocol which is a lot more work and requires a server.