This is almost exactly how my proposed NIP 87 works, except the group is recognized by p-tagged recipient, so members check directly for all keys for the group that have been shared with them. But I thought MLS solved this through the hierarchical key derivation stuff? My impression was that MLS made it possible to make the number of messages that need to be sent scale logarithmically with the number of recipients, without resorting to shared keys.