Authorization is enforced by the relay rather than by encryption, so you can have "private" groups, just not "I'm a spy" private groups