…
- ML-KEM Ratchet
- auto or manual
- KDFChain
- per-message
- Message key + ciphertext
- used once, then wiped
- sealFileKey() link
- streamed in chunks
- SealStream frame
- in-order, signed
- Seal encrypted relay
- per recipient
- Ed25519 sig verified
- before decrypt
- Fingerprint
- BLAKE3 of sign key