[jiveturkey]

I didn't investigate this requirement, but it's probably insufficiently thought out. Presumably you need E2E encryption so that the SP can't intercept (either willfully, compelled, or as a result of compromise) en masse. If that's the case, then you also need to have a way to verify keys of both parties, and you need a way to do that for group communications.

This is hard.

So even if Zoom is E2E, this is checkbox compliance. (if my assumptions are correct for the reasons behind it)