Thank you! That's a clean design.

The concept of per-user key wrapping is interesting.

I learned this the hard way... just because a wrapped key exists on the server doesn't guarantee the recipient can actually unwrap it—for instance, if the recipient's identity key has changed due to a re-installation. Implementing a mechanism to verify successful decryption on the client side before discarding the old key helped prevent situations where users would lose access to their own data.