All messages are encrypted with one key. Break one key, and all messages will be accessible to an attacker. Proper encryption protocols rotate encryption keys and compromising one message will not compromise the rest.

The situation is a bit more nuanced, given the large feature set that Matrix is trying to implement.

> Break one key, and all messages will be accessible to an attacker.

How do you propose breaking that one key, though? The attacker also needs to somehow acquire access to the key backup and to the encrypted messages, so it's a multi-step process.

The encryption protocol does rotate message keys. In fact it uses the same cryptographic primitives as Signal, that is the double ratchet algorithm.

I think you're conflating the message encryption protocol with cold storage, which is the purpose the key backup serves. It's completely typical for backups to be encrypted with a single symmetric key.

Finally, the key backup is completely optional and can be disabled.

So PGP and the encryption protocol of Threema aren't proper encryption protocols?

Then, how do you break the key?

Brute force? If you break one key that way, it's likely you could break equally secure keys as well.

Access to the device? Well then you have access to everything anyways