key agreement is x3dh over curve25519: a prekey bundle, an ephemeral handshake, and a shared secret neither the server nor a passive observer ever sees. the double ratchet advances the key on every message, so one compromised key never unlocks the thread.

the server is deliberately dumb. it routes ciphertext and stores prekeys, nothing more — no plaintext, no metadata it doesn't strictly need. the real engineering is on the client, where ratchet state has to survive app restarts without ever touching disk in the clear.