Most seamless end-to-end encrypted solution I've come across. And it's still in beta. Every piece is open source (I'm running my own server), it's federated, supports history sync as a first-citizen feature, individual read receipts for group messages. The UX is not as polished as Telegram, but it's improving rapidly and is more than usable as a daily driver.
If it's because Apple tells me so then I think can see that the end to end encryption is broken and interception is possible.
Are old messages re-encrypted with the new key?
This would be even worse.
It would still be possible to implement this in a secure way (including out-of-band key verification) by having the "original" key (the one you've compared out-of-band) sign keys for new devices and have the server deliver that signature (which the sender can then verify). I don't know if there are any implementations of this.
The thing which is really sad is that there are no end to end encrypted group chats.
e2e is in beta still, but they have key list management/verification in place already.
How do you accomplish a seamless swap from desktop to a mobile session using end-to-end encryption?