> When the selling point is security, insecure implementations don't help us. I'm not sure using a proxy is my preferred solution either, but if you're worried

> When the selling point is security, insecure implementations don't help us. I'm not sure using a proxy is my preferred solution either, but if you're worried about insecure implementations doesn't it make a ton of sense to separate the E2EE implementation from the rest of the client implementation? My ideal when using an experimental Matrix client if I don't know the developers involved would be for their experimental code to be quarantined away from the encryption code. That way I don't have to worry so much about whether their implementation is insecure, I know they're just using something off-the-shelf. Whether the proxy in specific is the best way to do that, :shrug:, but my instinct is that pushing messages through some kind of separate encryption/decryption handler that can be verified on its own and reused by multiple clients isn't a bad idea. That approach seems like good security practice to me. Am I missing something?