Ask two questions about any encrypted message, and they are not the same question. The first is: “who else could read this?” That’s what encryption answers — nobody in between, nobody waiting on the server, nobody with the keys but the person you sent it to. The second question is quieter and easier to miss: “are you sure this is actually the person you’re talking to?”
Most messengers only ever answer the first one out loud. The second is silently outsourced to the vendor — you trust that the servers routed your words to the right person, and that the name on the screen is the person behind it. That’s the difference a sovereign messenger is about: not asking anyone to vouch for who wrote a message, but checking it yourself.
Ciphertext is not the same as proof
On a rented messenger, encryption and identity are handled in two different rooms. Cryptography scrambles the message so nobody along the way can read it — and then the service, the same service that runs the servers, tells you who the message is from. The encryption protects the content; the identity is an act of faith in the operator.
That split is the weak spot. A messenger can encrypt the daylights out of a message and still be guessing about the sender, because the claim of “who wrote this” is made by the same entity that could have reasons to be wrong — or to be convenient. Sovereignty starts where you stop accepting that arrangement: the content is encrypted, and the sender’s identity is something the incoming message itself has to prove before you’re shown a single word of it.
Proof of the sender’s key, or it never reaches the screen
That’s exactly the direction the recent work in Infium took. As of v0.9.104 (2026-11-04): “Every encrypted message must now come with proof of the sender’s key before it is shown; a message that cannot be verified this way is no longer displayed.”
Read that sentence carefully, because the order is the whole point. The message isn’t shown first and verified afterward, as a nice-to-have that rarely triggers. Verification is the gate before display. An incoming message has to present the key that proves who sent it — and if it can’t, it simply never becomes a bubble on your screen. Your conversation doesn’t render a placeholder or a suspicious “could be from anyone” row; it declines to show the message at all.
This is the concrete mechanics behind a strong sovereign claim: the message only exists in your chat once the messenger can stand behind who wrote it. Ciphertext stops people from reading along the way; the sender key stops anyone from being the sender without proof. Each one covers a hole the other leaves open.
The little locks were training wheels — now they’re gone
You might have seen the small lock icons that used to appear under some messages. They were honest in intent, but they were also a tell. A lock icon that shows up after the fact, as a label on an already-rendered message, is a marker of a system still working its way toward strict verification — a temporary badge while the stricter check was being switched on.
That marker is now retired. v0.9.104 removed the little lock icons: “They were a temporary marker while we switched to the stricter check, and they are no longer needed.”
There’s something satisfying in deleting a badge. A lock that has to be drawn in as a special case is a compromise — a way of saying “this one checked out, and also here’s a reminder that checking even happens.” When the check becomes the default behavior of every message, the badge has nothing left to point at. The guarantee stops being something a few messages earn and becomes the baseline every message is held to.
If someone’s on a very old Infium, their messages wait for them to update
Strictness has a cost, and it’s an honest one to name. If you’re chatting with someone still on a very old version of Infium, their messages won’t come through until they update. The release says it plainly: “If you chat with someone on a very old version of Infium, ask them to update — their messages will not come through until they do.”
This is the trade-off, made explicit rather than hidden. The messenger would rather hold a message and tell you your friend is out of date than show you something it couldn’t verify. A weaker system would downgrade to “probably fine, show it anyway” to keep things smooth. A sovereign system prefers a moment of friction over a single unverifiable assumption — because that assumption, repeated, is exactly how identity gets quietly handed to someone it doesn’t belong to.
Trusting the message itself, not the middleman
When people argue about messenger sovereignty, encryption is usually the opening move: nobody in between can read what you send. That’s true and it matters. But encryption alone leaves the most human gap wide open — the question of whether the person at the other end is who their name says they are.
On a rented messenger, you answer that question by trusting the vendor. On sovereign XMPP, you don’t need to: the incoming message has to present proof of its sender before it’s shown, and a message that can’t is declined outright. The identity you see on the screen is one you were able to check for yourself. Encryption is the ground all of this stands on, and it has to work — but proving who wrote a message is what turns that ground into a conversation you can actually trust.
This is the same instinct that runs through everything sovereign: sovereignty isn’t just your server and your keys — it’s that you stop having to believe the middleman. Sending a message and having it delivered no matter what happens to either device is about not being held hostage by infrastructure. Proving the sender before you see a word is about not being held hostage by assumptions.
The bottom line
Encryption answers who else could read this. The sender key answers are you sure this is really them. One protects the content from the crowd; the other protects the conversation from impostors.
On sovereign XMPP, both are your own. An incoming message isn’t taken at the server’s word — it has to prove who sent it before it ever appears, and anything it can’t prove never reaches your screen. That’s what makes the difference between a messenger that protects your words and a messenger that protects your relationships.
Infium is a live XMPP server with end-to-end encryption where every message is verified against the sender’s key before it’s shown. Request an invite or try the live demo — no signup wall, it runs in your browser.