That would work, but historically this hasn't proven necessary and double encryption means double the CPU power (or more, if one of them has CPU extensions and

That would work, but historically this hasn't proven necessary and double encryption means double the CPU power (or more, if one of them has CPU extensions and the other encryption method does not). Doing group calls in Wire is already very taxing on nowadays' energy-efficient laptops or not-high-end phones. For example, people have been using Russian GOST algorithms as a hedge against the USA stuff, but it's falling out of style because it just hasn't proven necessary in the decades since the AES and SHA families came into existence. Any bugs we found, for example in SHA-1, affected everyone equally and did not create a backdoor as with Dual-EC (in which flaws were identified before release and which went unaddressed, very much unlike other common algorithms).