This solution works then, right? So given this implementation (and not a play store or ios download), one should be safe from xzy snooping?

Edit: As someone that has heard of forward secrecy but not how it relates to pgp, these were helpful reads:

https://signal.org/blog/advanced-ratcheting/

https://signal.org/blog/asynchronous-security/