End-to-end encrypted messaging

Design the backend for an end-to-end encrypted messaging service with 200M users supporting 1:1 and group chats, multi-device, and offline delivery, where the server itself must never be able to read message content. It must deliver messages with p99 under 200ms when recipients are online, queue for offline devices, and provide forward secrecy so that compromising a device's current key doesn't decrypt past messages. Cover key distribution, the encryption/trust model, group messaging, and multi-device.