Thanks! Yes, that’s true. It’s certainly not as easy as pulling a bunch of events from relays and decrypting them.
Thankfully the mls implementations do a great job of managing most of the state. Clients that want to implement this need to think about secure storage of the prekeys (but this is pretty much the same as looking after someone’s nsec).