The encryption question has one answer
In Enclessa a direct message is end-to-end encrypted with MLS and there is no administrator override, no key escrow and no setting that quietly turns it off. That is a property of the room, not a policy somebody has to maintain.