We Just Shipped End-to-End Encryption — And Deliberately Broke Half of Kanvo To Do It
Private conversations are live: MLS between your devices, ciphertext on our servers, and no search, no assistant, no calls inside them. Here is exactly what you lose, and why we shipped it anyway.
What we actually built
Private conversations use MLS (RFC 9420) — the IETF standard for group messaging, not a homegrown ratchet. One implementation, written once in Rust, compiled into every client: web, iPhone, Mac, Android and Windows all run the same protocol code rather than five interpretations of a spec.
The part nobody advertises: what stops working
An encrypted conversation is a conversation your provider cannot help you with. Inside a private conversation, these are gone, not "coming soon":
Why not just encrypt everything
Because Proof of Send exists, and it points the other way. A signature proves authorship to a third party; end-to-end encryption exists to stop exactly that. A regulated company that needs to prove an agent was authorised to send a message cannot also need that message to be unreadable by anyone but the recipient.
Safety numbers
Every private conversation has a sixty-digit safety number, shown in twelve groups of five. Compare it out loud with the person you are talking to and you have ruled out a machine in the middle. If it changes, someone added or re-keyed a device, and you will be told.
Try it
Start a new message, choose a private conversation, and watch the lock appear. It sits beside your ordinary conversation with the same person rather than replacing it — converting an existing thread would leave its history readable while the lock said otherwise, which is a lie we were not willing to draw.
Kanvo Team
Writes here about what Kanvo is building and why — the send path, the evidence it leaves, and the decisions behind both.
Related Articles
Every native Kanvo message is now attested the moment it is sent, and generating or checking a proof costs zero credits — forever, for everyone. Here's the receipts-first reasoning.
We Looked At Our Own Pricing Page And Deleted a Line Item. Proofs Are Now Free
Every native Kanvo message is now attested the moment it is sent, and generating or checking a proof costs zero credits — forever, for everyone. Here's the receipts-first reasoning.
Your Safety Number Just Changed. Here's How To Find Out Who To Blame
Every device key Kanvo has ever published is now in an append-only log, anchored publicly, and served at a URL you can read without asking us. Encryption you cannot audit is a promise, not a property.
Proof of Send: Every Message Kanvo Delivers Is Now Signed
Kanvo now signs every outbound message with a record of who sent it, on whose authority, and whether it disclosed itself as AI — appended to a hash-chained ledger anchored in Sigstore Rekor and Bitcoin.
Enjoyed this article?
Subscribe to our newsletter for more insights and updates.