I think 2 and 3 are incorrect under my scheme. If parties host key fragments themselves, unencrypted, then I'd agree with both 2 and 3. However if the keys ar

I think 2 and 3 are incorrect under my scheme. If parties host key fragments themselves, unencrypted, then I'd agree with both 2 and 3. However if the keys are encrypted in such a way that parties can only decrypt them by posting confirmation to a blockchain (or equivalent), two things occur: 2a. The parties have a very strong incentive to secure their transaction-posting-keys, because those are the same keys as they use to protect their own other valuable assets such as cryptocurrency, or whatever else they are securing these days such as DAO governance. Some people will be sloppy (and lose their own money and other things), but on a large scale, perhaps it's an open question so far how many people will be that sloppy. If it's not too many people, the system is not compromised. 3a. Any party will become aware their own transaction-posting-key is used as soon as they see a transaction under their identity posted to the blockchain they participate in. They can also see how it's used. I've said blockchain but it doesn't actually need a blockchain. If there is one, it can be private or public. Either way, 2a and 3a apply. The main thing is there is an agreed "consensus location" into which people can choose whether to pool enough information to reconstitute the originally protected conversation key, with their only unencrypted secret being their multi-use key they are strongly incentivised to guard (2a), and to which they will only post if they can detect when it's used and limit how it's used (3a).