I'm not going to bother digging further to see how keys are managed.
For all I know, the cipher mode is smoke and mirrors and everyone is using the same hard-coded AES key somewhere to encrypt their chats.
Don't use xPal.When you consider how it's marketed, the features they emphasize, the fact that it's not open source, and the low quality review they're trying to pass off as an "audit", this thing is either a textbook example of developer hubris or it's another law enforcement sting operation.