How about this..

- User creates a group chat

- The client creates a private/public keypair for the group

- User invites others to join, which sends them the keypair

- When a user posts to the group chat, their inner message is signed by their private key. That signed message is wrapped in an outer message signed by and encrypted with the group chat private key

- Timestamps are used to properly order messages in the group chat

That would keep the group chat membership private. Subscribed clients watch for new messages sent to the group's npub.