End-to-end encryption pitfalls which might not be obvious (twitter.com)

Synopsis for those who do not want to read a twitter thread.

Pitfalls:

1. People lose their keys. Design around that, so users stay happy. Super difficult since everyone looses their keys eventually.

2. People have their keys stolen.

3. Abuse of various parties and how to moderate.

4. Web E2EE is hard.

5. Multiple devices add corner cases that may introduce security issues.

I wouldn't say you always need message franking. A lot of services make it an explicit goal that the recipient can't prove the sender actually wrote any given message, for good reason.