> I hope that with enough traction and some investment, I'll be able to hire an expert to help add privacy features that I can advertise in good faith.
Now is a really good time to learn. Seriously. libsodium is an excellent example of a library which provides user-friendly APIs that don't require you to roll your own crypto and is very strongly audited by experts — see https://libsodium.gitbook.io/doc/public-key_cryptography/aut... for an illustration. There are lots of other similarly good libraries. All you need to do is to implement some public key infrastructure, making sure that private keys stay private and never leave the user's device and that you can look up the published public key of another user.
Now is a really good time to learn. Seriously. libsodium is an excellent example of a library which provides user-friendly APIs that don't require you to roll your own crypto and is very strongly audited by experts — see https://libsodium.gitbook.io/doc/public-key_cryptography/aut... for an illustration. There are lots of other similarly good libraries. All you need to do is to implement some public key infrastructure, making sure that private keys stay private and never leave the user's device and that you can look up the published public key of another user.