Draft Service Message Multicast protocol

[gnarea]

Executive summary

This protocol will allow a given endpoint to send the same parcel to multiple recipients, in such a way that (1) the sender only delivers a single message and its gateway will propagate it and (2) each recipient is able to decrypt the message with their corresponding key.

Technical details

We're already using CMS EnvelopedData values to serialise the ciphertext and we could just add recipients with minimal changes. However, it'd be good to consider other approaches just in case.

I've had a very superficial look at the Signal Private Group System but it seems very promising and I think we could use it to implement this functionality.

See also: https://blog.phnx.im/rfc-9420-mls/

See #43 for the broadcast counterpart.