1. Forward secrecy on member churn
Add three members (Alice, Bob, Carol). Send a message as Alice. Switch the viewer to Bob — he can read it. Remove Bob. Send another message as Alice. Switch viewer back to Bob: he can't read the new message. That's the cryptographic property — Bob's device no longer has the epoch key the message was sealed under.
2. Backward security on join
Send a message as Alice early. Then add a new member, Dan. Switch the viewer to Dan and look at the early message: he sees ciphertext. The epoch key for that message existed before Dan joined; his device never received it. This is what prevents a new admin from reading historical confidential threads.
3. The server-blind property
At any time, switch the viewer to Koaich server (what we hold). Every message is ciphertext. The server sees the sender id, the epoch number, and the timestamp — never the content. Every operation in the log is something the server can observe; the content of messages is something the server cannot.
4. Forward secrecy without churn
Click Re-key (no churn). The group key rotates to a new epoch with no membership change. A future device compromise that recovers an old epoch key can't decrypt messages from later epochs. Real MLS does this automatically on every message via key ratcheting; this button lets you trigger it manually.