Alice & Bob exchange public keys → derive shared symmetric key (ECDH). Each message is encrypted with AES-256-GCM using a unique nonce. Messages are signed with ...