I agree there are more layers you can add on top of TweetNaCl to improve security.
I'm going to personally add you to the list of people Bluesky should hire to get this implemented without the consent of the Bluesky employees. If they choose to hire both of us perhaps we can figure out how to implement this for them.
I will not commit to putting on a furry suit. But I've been known to try everything once. And bonus I live right next to the furry convention center and have always wondered what the heck is going on at the Hyatt while you guys are here.
I won't go out of my way to find out if you don't want it known. If you decide you want to know what's going on in the hotel, there's probably lots of video on YouTube from whichever convention it is.
https://github.com/soatok/rawr-x3dh
I'm telling you, TweetNaCl is not enough to build a secure messenger
libsodium, maybe