Signed events are the right primitive for this. The keypair is the identity, so a station can hand messages between strangers and still prove authorship with no server in the loop. The write side is where it usually breaks. My own relay only takes writes from a whitelist after the client authenticates, and a station that accepts writes from anyone in BLE range collects junk faster than it can sync. Every station relays what it stores, after all. Proof-of-work admission or a per-station allowlist fixes that, at the cost of friction for the people who need it most. Second limit: BLE frames are tiny. Text fits, images do not, so the apps should degrade visibly instead of silently dropping attachments. How are you handling sync when two stations meet after weeks apart?