Spinnin' hard on a tangent here, but hey, that's what Nostr's for.
Still getting my feet wet on Nostr devvin' here, but from what I understand we can spin up custom relays, tweak 'em a bit, and allow-list events only from a given list of npubs. A la paid relays.
Here's where I'm fuzzy (for now); event propagation / broadcast between relays happens at the *client* level, it would seem? Though I'd imagine that gossip between relays *also* occurs / can occur. Still learning that bit.
In which case, I can imagine a client capable of storing thread-specific private keys (Signal does something like this, doesn't it?) and auto-decrypts messages you've got the keys for.
Add a relay-level gossip circle that forms a cluster to maintain redundancy, while discouraging propagation to relays that don't implement the unlocking mechanism of the key-managing client.
Something like that 😹