Or you could just use the ECDH as outer key. Less subscriptions. And if you want plausible deniability ("the other guy sent it") you could skip signing the inner message.