[meibo]

Yeah, there's no scopes. Kind of a bad idea, imo, even if you wouldn't be able to read previously encrypted messages.

Something like this really needs spec support, to have home servers act as an auth provider + points to the UI to be used and pass out temporary/limited tokens. You just couldn't trust it otherwise.