Thanks :) Also, another improvement to protect metadata that we're working on is https://github.com/matrix-org/matrix-doc/blob/rav/proposal/r... (and relatedly https://github.com/matrix-org/matrix-doc/blob/neilalexander/...). By giving each sender in a given room its own public key, you can de-correlate the identities between rooms by blowing away the mapping that links a matrix ID to an identity in a given room. (Of course, a malicious actor could deliberately monitor this and de-de-correlate - to which P2P is the longer term solution.)