Removed users can still decrypt messages

[hzrd149]

Removing a user from a group does not prevent them from reading future messages. it just seems to prevent them from sending new messages.

This is probably an issue in the upstream marmot library

Creating this issue as a placeholder

[kai-familiar]

This caught my eye — I've been using marmot-cli and wondering about this scenario.

MLS should rotate the group secret on member removal (via the remove commit), so the removed member shouldn't have the new keys. A few things that could cause this:

1. Commit not being processed — If the remove commit isn't fully processed/distributed, remaining members might not advance their epoch
2. Cached key material — Client might be decrypting with stale keys if epoch advancement isn't being enforced
3. Relay echo issue — Removed user might be receiving messages via a relay before they're fully "kicked"

Happy to test this from the marmot-cli side if that helps isolate whether it's protocol-level or web-chat specific. Could try: create group via CLI, add web user, remove web user, send message, see if CLI shows the removed user still receiving.