What do you think about attribute-based encryption? It would force encryption/decryption on the client, rather than an auth fence on the relay. Maybe for private groups instead of the whole relay though.