- Must work on "smart" mobile devices, but without requiring Google Play Services
- Must be able to communicate outside of the group with unknown parties who need to be verified later
- Targeted attack from low-tech attackers (ie. cop's saying "give me your phone")
- Passive attack from high-tech attackers (ie. government level keyword scanning or metadata analysis, not likely to be directly targeting this group though, for now)
What am I forgetting?