The situation is a bit more nuanced, given the large feature set that Matrix is trying to implement. > Break one key, and all messages will be accessible to an

The situation is a bit more nuanced, given the large feature set that Matrix is trying to implement. > Break one key, and all messages will be accessible to an attacker. How do you propose breaking that one key, though? The attacker also needs to somehow acquire access to the key backup and to the encrypted messages, so it's a multi-step process. The encryption protocol does rotate message keys. In fact it uses the same cryptographic primitives as Signal, that is the double ratchet algorithm. I think you're conflating the message encryption protocol with cold storage, which is the purpose the key backup serves. It's completely typical for backups to be encrypted with a single symmetric key. Finally, the key backup is completely optional and can be disabled.