Adapt existing setting to only send to verified devices for cross-signing

[jryans]

We have the existing setting "Never send encrypted messages to unverified devices from this device" which should be adapted for cross-signing as below:

Open questions:

• What happens when send a message with this enabled? Are you prevented from sending entirely?

See also the related https://github.com/vector-im/riot-web/issues/11807.

[jryans]

@nadonomy, please review the questions above with your product hat on.

[nadonomy]

• What happens when send a message with this enabled? Are you prevented from sending entirely?

Yep, this is a fairly advanced "I never ever want to encrypt a message for an untrusted device" setting for the more extreme security conscious use cases.

We'd likely want some feedback on the composer to explain why it's disabled, but this supporting this feature in general is definitely low priority compared to us getting everything else working, and I don't believe to be table stakes for e2e by default even.

[jryans]

@nadonomy, okay that makes sense.

I suppose one thing to make clear is that for this issue, we already expose a very similar (if not identical in function but differing in label) setting for "Never send encrypted messages to unverified devices from this device", which remains in place unless we take some action. Is it okay to leave that alone for now, which is what would happen leaving this as low priority?

[nadonomy]

Yeah for sure. I'd advocate for us leaving existing settings as is for now while we're in the bulk of cross-signing etc— allocating some time to clean up settings as probably the last 'greenfield' e2e changes in the e2e-by-default dev cycle.

[dbkr]

So to clarify message sending behaviour, it should be:

With this setting disabled:

• Regardless of room shield colour: Send message to all devices in room

With it enabled:

• Room has green or black shield: Send message to all devices in room
• Room has red shield: disable composer

When we introduce this setting it should inherit the value of, and replace, the old, "Never send messages to untrusted sessions" setting.

[dbkr]

agh, also we shouldn't forget that the old setting could be set at both the account and room level. Which of these settings are we planning on allowing the user to set per-room as well as per-account?

[florianjacob]

Had some troubles with the old setting and initial cross-signing:
#13656