Now for comparison’s sake, try snikket, or even barebones ejabberd on a (featuresfriendliness) vs (admin overheadserver resources) basis. Mix in some https://mov.im/ if you must.

I’ve said that before, but the O(N²) issue with E2E encryption only exists in an ideological sense. If your group chat is large enough that the overhead is unbearable, you don’t have a private and secure group chat to begin with, just because a group chat of this magnitude is very much public by definition.

With that said, you can keep server logs encrypted while avoiding the payload/key rotation explosion by using static keys (available since forever with PGP in XMPP) or wait the decade (but most probably, the eternity) that it will take for MLS to be bolted on top of Matrix (and the new protocol design that this entails due to the absence of guarantee about messages ordering)