Sounds like you both need to review what I have done with group chats in Nymchat 😅 Ephemeral keys used for every message. Each key is saved to a time-bucketed self-addressed gift wrap. Your next key is inside the encrypted rumor sent to participants. The only real possible metadata leak is that there is a REQ to each key to check for any messages to them, so someone monitoring the relay could infer these sets of pubkeys are linked to this IP, but that's it. You could of course shard the REQ and use proxy to mitigate that.