We’ll do a write-up on the website in the future. In short the calls are encrypted between browsers. We do not have a PKI so we can not client-side check for MITM attacks, but of course we authenticate clients server-side. So, calls are encrypted end-to-end but also places faith in that our infrastructure is not compromised.