diff --git a/keyserver/src/responders/website-responders.js b/keyserver/src/responders/website-responders.js
index 694d0a3ac..5857d9bc1 100644
--- a/keyserver/src/responders/website-responders.js
+++ b/keyserver/src/responders/website-responders.js
@@ -1,411 +1,406 @@
 // @flow
 
 import html from 'common-tags/lib/html/index.js';
 import { detect as detectBrowser } from 'detect-browser';
 import type { $Response, $Request } from 'express';
 import fs from 'fs';
 import * as React from 'react';
 // eslint-disable-next-line import/extensions
 import ReactDOMServer from 'react-dom/server';
 import { promisify } from 'util';
 
 import stores from 'lib/facts/stores.js';
 import getTitle from 'web/title/get-title.js';
 
 import { waitForStream } from '../utils/json-stream.js';
 import {
   getAndAssertKeyserverURLFacts,
   getAppURLFactsFromRequestURL,
   getWebAppURLFacts,
 } from '../utils/urls.js';
 
 // eslint-disable-next-line react/no-deprecated
 const { renderToNodeStream } = ReactDOMServer;
 
 const access = promisify(fs.access);
 const readFile = promisify(fs.readFile);
 
 const googleFontsURL =
   'https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600&family=Inter:wght@400;500;600&display=swap';
 const localFontsURL = 'fonts/local-fonts.css';
 async function getFontsURL() {
   try {
     await access(localFontsURL);
     return localFontsURL;
   } catch {
     return googleFontsURL;
   }
 }
 
 type AssetInfo = {
   +jsURL: string,
   +fontsURL: string,
   +cssInclude: string,
   +olmFilename: string,
   +commQueryExecutorFilename: string,
-  +opaqueURL: string,
   +backupClientFilename: string,
   +webworkersOpaqueFilename: string,
 };
 let assetInfo: ?AssetInfo = null;
 async function getAssetInfo() {
   if (assetInfo) {
     return assetInfo;
   }
   if (process.env.NODE_ENV === 'development') {
     const fontsURL = await getFontsURL();
     assetInfo = {
       jsURL: 'http://localhost:8080/dev.build.js',
       fontsURL,
       cssInclude: '',
       olmFilename: '',
       commQueryExecutorFilename: '',
-      opaqueURL: 'http://localhost:8080/opaque-ke.wasm',
       backupClientFilename: '',
       webworkersOpaqueFilename: '',
     };
     return assetInfo;
   }
   try {
     const manifestString = await readFile('../web/dist/manifest.json', 'utf8');
     const manifest = JSON.parse(manifestString);
     const webworkersManifestString = await readFile(
       '../web/dist/webworkers/manifest.json',
       'utf8',
     );
     const webworkersManifest = JSON.parse(webworkersManifestString);
     assetInfo = {
       jsURL: `compiled/${manifest['browser.js']}`,
       fontsURL: googleFontsURL,
       cssInclude: html`
         <link
           rel="stylesheet"
           type="text/css"
           href="compiled/${manifest['browser.css']}"
         />
       `,
       olmFilename: manifest['olm.wasm'],
       commQueryExecutorFilename: webworkersManifest['comm_query_executor.wasm'],
-      opaqueURL: `compiled/${manifest['comm_opaque2_wasm_bg.wasm']}`,
       backupClientFilename: webworkersManifest['backup-client-wasm_bg.wasm'],
       webworkersOpaqueFilename: webworkersManifest['comm_opaque2_wasm_bg.wasm'],
     };
     return assetInfo;
   } catch {
     throw new Error(
       'Could not load manifest.json for web build. ' +
         'Did you forget to run `yarn dev` in the web folder?',
     );
   }
 }
 
 let webpackCompiledRootComponent: ?React.ComponentType<{}> = null;
 async function getWebpackCompiledRootComponentForSSR() {
   if (webpackCompiledRootComponent) {
     return webpackCompiledRootComponent;
   }
   try {
     // $FlowFixMe web/dist doesn't always exist
     const webpackBuild = await import('web/dist/app.build.cjs');
     webpackCompiledRootComponent = webpackBuild.app.default;
     return webpackCompiledRootComponent;
   } catch {
     throw new Error(
       'Could not load app.build.cjs. ' +
         'Did you forget to run `yarn dev` in the web folder?',
     );
   }
 }
 
 function stripLastSlash(input: string): string {
   return input.replace(/\/$/, '');
 }
 
 async function websiteResponder(req: $Request, res: $Response): Promise<void> {
   const { basePath } = getAppURLFactsFromRequestURL(req.originalUrl);
   const baseURL = stripLastSlash(basePath);
 
   const keyserverURLFacts = getAndAssertKeyserverURLFacts();
   const keyserverURL = `${keyserverURLFacts.baseDomain}${stripLastSlash(
     keyserverURLFacts.basePath,
   )}`;
 
   const loadingPromise = getWebpackCompiledRootComponentForSSR();
 
   const assetInfoPromise = getAssetInfo();
   const {
     jsURL,
     fontsURL,
     cssInclude,
     olmFilename,
-    opaqueURL,
     commQueryExecutorFilename,
     backupClientFilename,
     webworkersOpaqueFilename,
   } = await assetInfoPromise;
 
   // prettier-ignore
   res.write(html`
     <!DOCTYPE html>
     <html lang="en">
       <head>
         <meta charset="utf-8" />
         <title>${getTitle(0)}</title>
         <base href="${basePath}" />
         <link rel="stylesheet" type="text/css" href="${fontsURL}" />
         ${cssInclude}
         <link
           rel="apple-touch-icon"
           sizes="180x180"
           href="apple-touch-icon.png"
         />
         <link
           rel="icon"
           type="image/png"
           sizes="32x32"
           href="favicon-32x32.png"
         />
         <link
           rel="icon"
           type="image/png"
           sizes="16x16"
           href="favicon-16x16.png"
         />
         <link rel="manifest" href="site.webmanifest" />
         <meta name="apple-mobile-web-app-title" content="Comm" />
         <meta name="application-name" content="Comm" />
         <meta name="msapplication-TileColor" content="#b91d47" />
         <meta name="theme-color" content="#b91d47" />
       </head>
       <body>
         <div id="react-root">
   `);
 
   const Loading = await loadingPromise;
   const reactStream = renderToNodeStream(<Loading />);
   reactStream.pipe(res, { end: false });
 
   await waitForStream(reactStream);
   res.end(html`
     </div>
     <script>
           var keyserverURL = "${keyserverURL}";
           var baseURL = "${baseURL}";
           var olmFilename = "${olmFilename}";
           var commQueryExecutorFilename = "${commQueryExecutorFilename}";
           var backupClientFilename = "${backupClientFilename}";
           var webworkersOpaqueFilename = "${webworkersOpaqueFilename}"
-          var opaqueURL = "${opaqueURL}";
         </script>
         <script src="${jsURL}"></script>
       </body>
     </html>
   `);
 }
 
 const inviteSecretRegex = /^[a-z0-9]+$/i;
 
 // On native, if this responder is called, it means that the app isn't
 // installed.
 async function inviteResponder(req: $Request, res: $Response): Promise<void> {
   const { secret } = req.params;
   const userAgent = req.get('User-Agent');
   const detectionResult = detectBrowser(userAgent);
   if (detectionResult.os === 'Android OS') {
     const isSecretValid = inviteSecretRegex.test(secret);
     const referrer = isSecretValid
       ? `&referrer=${encodeURIComponent(`utm_source=invite/${secret}`)}`
       : '';
     const redirectUrl = `${stores.googlePlayUrl}${referrer}`;
     res.writeHead(301, {
       Location: redirectUrl,
     });
     res.end();
     return;
   } else if (detectionResult.os !== 'iOS') {
     const urlFacts = getWebAppURLFacts();
     const baseDomain = urlFacts?.baseDomain ?? '';
     const basePath = urlFacts?.basePath ?? '/';
     const redirectUrl = `${baseDomain}${basePath}handle/invite/${secret}`;
     res.writeHead(301, {
       Location: redirectUrl,
     });
     res.end();
     return;
   }
   const fontsURL = await getFontsURL();
   res.end(html`
     <!doctype html>
     <html lang="en">
       <head>
         <meta charset="utf-8" />
         <title>Comm</title>
         <link rel="stylesheet" type="text/css" href="/${fontsURL}" />
         <style>
           * {
             -webkit-font-smoothing: antialiased;
             -moz-osx-font-smoothing: grayscale;
             box-sizing: border-box;
             padding: 0;
             margin: 0;
           }
 
           html {
             height: 100%;
             font-size: 112.5%;
           }
 
           body {
             font-family:
               'Inter',
               -apple-system,
               'Segoe UI',
               'Roboto',
               'Oxygen',
               'Ubuntu',
               'Cantarell',
               'Fira Sans',
               'Droid Sans',
               'Helvetica Neue',
               ui-sans-serif;
             background: #0a0a0a url('/images/invite_link_background.png')
               no-repeat;
             background-size: cover;
             color: #ffffff;
             display: flex;
             flex-direction: column;
             justify-content: space-around;
             align-items: center;
             height: 100%;
             padding: 1.6rem;
             font-size: 1.8rem;
             line-height: 2.4rem;
             font-weight: 500;
           }
 
           section {
             display: flex;
             flex-direction: column;
             align-items: center;
             justify-content: space-between;
             width: 100%;
           }
 
           .card {
             width: 100%;
             padding: 3.2rem 1.6rem;
             gap: 4rem;
             background-color: #1f1f1f;
             border-radius: 1.6rem;
           }
 
           .buttons {
             gap: 1.2rem;
           }
 
           h1 {
             font-size: 3.6rem;
             line-height: 1.5;
             font-weight: 500;
             font-family: 'IBM Plex Sans', sans-serif;
           }
 
           p {
             text-align: center;
           }
 
           .separator {
             border: 1px solid #404040;
             width: 100%;
           }
 
           .button {
             all: unset;
             box-sizing: border-box;
             display: flex;
             justify-content: center;
             align-items: center;
             width: 100%;
             padding: 1.7rem;
             border-radius: 0.4rem;
             border: 1px solid transparent;
             background-color: #6d49ab;
             font-size: 1.6rem;
             line-height: 1.5;
           }
 
           .button.secondary {
             background-color: #1f1f1f;
             border-color: #ffffff;
           }
 
           .link {
             all: unset;
             box-sizing: border-box;
             display: flex;
             align-items: center;
           }
 
           .link-text {
             text-decoration-line: underline;
           }
 
           .logo-container {
             background-color: #0a0a0a;
             width: 4.2rem;
             height: 4.2rem;
             display: flex;
             justify-content: center;
             align-items: center;
             border-radius: 50%;
           }
 
           .logo {
             height: 2.6rem;
           }
 
           .arrow {
             width: 1.8rem;
             height: 1.8rem;
           }
         </style>
       </head>
       <body>
         <div></div>
         <section class="card">
           <section>
             <div class="logo-container">
               <img
                 src="/images/loading_logo.svg"
                 alt="Comm logo"
                 class="logo"
               />
             </div>
             <h1>Comm</h1>
           </section>
           <p>
             To join this community, download the Comm app and reopen this invite
             link
           </p>
           <div class="separator"></div>
           <section class="buttons">
             <a class="button" href="${stores.appStoreUrl}">Download Comm</a>
             <a class="button secondary" href="comm://invite/${secret}">
               Invite Link
             </a>
           </section>
         </section>
         <a class="link" href="https://comm.app/">
           <span class="link-text">Visit Comm’s website</span>
           <img
             src="/images/arrow_up_right.svg"
             alt="arrow up right"
             class="arrow"
           />
         </a>
       </body>
     </html>
   `);
 }
 
 export { websiteResponder, inviteResponder };
diff --git a/web/app.react.js b/web/app.react.js
index 0cb4e846c..c8f5701e1 100644
--- a/web/app.react.js
+++ b/web/app.react.js
@@ -1,561 +1,558 @@
 // @flow
 
 import 'basscss/css/basscss.min.css';
 import './theme.css';
 import { config as faConfig } from '@fortawesome/fontawesome-svg-core';
 import classnames from 'classnames';
 import _isEqual from 'lodash/fp/isEqual.js';
 import * as React from 'react';
 import { DndProvider } from 'react-dnd';
 import { HTML5Backend } from 'react-dnd-html5-backend';
 import { WagmiConfig } from 'wagmi';
 
 import {
   fetchEntriesActionTypes,
   updateCalendarQueryActionTypes,
 } from 'lib/actions/entry-actions.js';
 import { ChatMentionContextProvider } from 'lib/components/chat-mention-provider.react.js';
 import { EditUserAvatarProvider } from 'lib/components/edit-user-avatar-provider.react.js';
 import {
   ModalProvider,
   useModalContext,
 } from 'lib/components/modal-provider.react.js';
 import { StaffContextProvider } from 'lib/components/staff-provider.react.js';
 import { IdentitySearchProvider } from 'lib/identity-search/identity-search-context.js';
 import {
   createLoadingStatusSelector,
   combineLoadingStatuses,
 } from 'lib/selectors/loading-selectors.js';
 import { isLoggedIn } from 'lib/selectors/user-selectors.js';
 import { extractMajorDesktopVersion } from 'lib/shared/version-utils.js';
 import type { SecondaryTunnelbrokerConnection } from 'lib/tunnelbroker/secondary-tunnelbroker-connection.js';
 import { TunnelbrokerProvider } from 'lib/tunnelbroker/tunnelbroker-context.js';
 import type { LoadingStatus } from 'lib/types/loading-types.js';
 import type { WebNavInfo } from 'lib/types/nav-types.js';
 import type { Dispatch } from 'lib/types/redux-types.js';
 import type { MessageToDeviceRequest } from 'lib/types/tunnelbroker/message-to-device-request-types.js';
 import { getConfig, registerConfig } from 'lib/utils/config.js';
 import { useDispatch } from 'lib/utils/redux-utils.js';
 import { infoFromURL } from 'lib/utils/url-utils.js';
 import { AlchemyENSCacheProvider, wagmiConfig } from 'lib/utils/wagmi-utils.js';
 
 import QrCodeLogin from './account/qr-code-login.react.js';
 import AppThemeWrapper from './app-theme-wrapper.react.js';
 import { authoritativeKeyserverID } from './authoritative-keyserver.js';
 import WebEditThreadAvatarProvider from './avatars/web-edit-thread-avatar-provider.react.js';
 import Calendar from './calendar/calendar.react.js';
 import Chat from './chat/chat.react.js';
 import { EditModalProvider } from './chat/edit-message-provider.js';
 import { MemberListSidebarProvider } from './chat/member-list-sidebar/member-list-sidebar-provider.react.js';
 import NavigationArrows from './components/navigation-arrows.react.js';
 import { olmAPI } from './crypto/olm-api.js';
-import { initOpaque } from './crypto/opaque-utils.js';
 import electron from './electron.js';
 import InputStateContainer from './input/input-state-container.react.js';
 import InviteLinkHandler from './invite-links/invite-link-handler.react.js';
 import InviteLinksRefresher from './invite-links/invite-links-refresher.react.js';
 import LoadingIndicator from './loading-indicator.react.js';
 import { MenuProvider } from './menu-provider.react.js';
 import UpdateModalHandler from './modals/update-modal.react.js';
 import SettingsSwitcher from './navigation-panels/settings-switcher.react.js';
 import Topbar from './navigation-panels/topbar.react.js';
 import useBadgeHandler from './push-notif/badge-handler.react.js';
 import { PushNotificationsHandler } from './push-notif/push-notifs-handler.js';
 import { updateNavInfoActionType } from './redux/action-types.js';
 import DisconnectedBar from './redux/disconnected-bar.js';
 import FocusHandler from './redux/focus-handler.react.js';
 import { KeyserverReachabilityHandler } from './redux/keyserver-reachability-handler.js';
 import { persistConfig } from './redux/persist.js';
 import PolicyAcknowledgmentHandler from './redux/policy-acknowledgment-handler.js';
 import { useSelector } from './redux/redux-utils.js';
 import VisibilityHandler from './redux/visibility-handler.react.js';
 import history from './router-history.js';
 import { MessageSearchStateProvider } from './search/message-search-state-provider.react.js';
 import AccountSettings from './settings/account-settings.react.js';
 import DangerZone from './settings/danger-zone.react.js';
 import KeyserverSelectionList from './settings/keyserver-selection-list.react.js';
 import { getCommSharedWorker } from './shared-worker/shared-worker-provider.js';
 import CommunityPicker from './sidebar/community-picker.react.js';
 import Splash from './splash/splash.react.js';
 import './typography.css';
 import css from './style.css';
 import { TooltipProvider } from './tooltips/tooltip-provider.js';
 import { canonicalURLFromReduxState, navInfoFromURL } from './url-utils.js';
 import { useWebLock, TUNNELBROKER_LOCK_NAME } from './web-lock.js';
 
-void initOpaque();
-
 // We want Webpack's css-loader and style-loader to handle the Fontawesome CSS,
 // so we disable the autoAddCss logic and import the CSS file. Otherwise every
 // icon flashes huge for a second before the CSS is loaded.
 import '@fortawesome/fontawesome-svg-core/styles.css';
 
 faConfig.autoAddCss = false;
 const desktopDetails = electron?.version
   ? { majorDesktopVersion: extractMajorDesktopVersion(electron?.version) }
   : null;
 
 registerConfig({
   // We can't securely cache credentials on web
   resolveKeyserverSessionInvalidationUsingNativeCredentials: null,
   setSessionIDOnRequest: true,
   // Never reset the calendar range
   calendarRangeInactivityLimit: null,
   platformDetails: {
     platform: electron?.platform ?? 'web',
     codeVersion: 75,
     stateVersion: persistConfig.version,
     ...desktopDetails,
   },
   authoritativeKeyserverID,
   olmAPI,
 });
 
 const versionBroadcast = new BroadcastChannel('comm_version');
 versionBroadcast.postMessage(getConfig().platformDetails.codeVersion);
 versionBroadcast.onmessage = (event: MessageEvent) => {
   if (event.data && event.data !== getConfig().platformDetails.codeVersion) {
     location.reload();
   }
 };
 
 // Start initializing the shared worker immediately
 void getCommSharedWorker();
 
 type BaseProps = {
   +location: {
     +pathname: string,
     ...
   },
 };
 type Props = {
   ...BaseProps,
   // Redux state
   +navInfo: WebNavInfo,
   +entriesLoadingStatus: LoadingStatus,
   +loggedIn: boolean,
   +activeThreadCurrentlyUnread: boolean,
   // Redux dispatch functions
   +dispatch: Dispatch,
   +modals: $ReadOnlyArray<React.Node>,
 };
 
 class App extends React.PureComponent<Props> {
   componentDidMount() {
     const {
       navInfo,
       location: { pathname },
       loggedIn,
     } = this.props;
     const newURL = canonicalURLFromReduxState(navInfo, pathname, loggedIn);
     if (pathname !== newURL) {
       history.replace(newURL);
     }
   }
 
   componentDidUpdate(prevProps: Props) {
     const {
       navInfo,
       location: { pathname },
       loggedIn,
     } = this.props;
     if (!_isEqual(navInfo)(prevProps.navInfo)) {
       const newURL = canonicalURLFromReduxState(navInfo, pathname, loggedIn);
       if (newURL !== pathname) {
         history.push(newURL);
       }
     } else if (pathname !== prevProps.location.pathname) {
       const urlInfo = infoFromURL(pathname);
       const newNavInfo = navInfoFromURL(urlInfo, { navInfo });
       if (!_isEqual(newNavInfo)(navInfo)) {
         this.props.dispatch({
           type: updateNavInfoActionType,
           payload: newNavInfo,
         });
       }
     } else if (loggedIn !== prevProps.loggedIn) {
       const newURL = canonicalURLFromReduxState(navInfo, pathname, loggedIn);
       if (newURL !== pathname) {
         history.replace(newURL);
       }
     }
     if (loggedIn !== prevProps.loggedIn) {
       electron?.clearHistory();
     }
   }
 
   onWordmarkClicked = () => {
     this.props.dispatch({
       type: updateNavInfoActionType,
       payload: { tab: 'chat' },
     });
   };
 
   render(): React.Node {
     let content;
     if (this.props.loggedIn) {
       content = (
         <>
           <WebEditThreadAvatarProvider>
             <EditUserAvatarProvider>
               <StaffContextProvider>
                 <MemberListSidebarProvider>
                   {this.renderMainContent()}
                   {this.props.modals}
                 </MemberListSidebarProvider>
               </StaffContextProvider>
             </EditUserAvatarProvider>
           </WebEditThreadAvatarProvider>
         </>
       );
     } else {
       content = (
         <>
           {this.renderLoginPage()}
           {this.props.modals}
         </>
       );
     }
     return (
       <DndProvider backend={HTML5Backend}>
         <EditModalProvider>
           <MenuProvider>
             <WagmiConfig config={wagmiConfig}>
               <AlchemyENSCacheProvider>
                 <TooltipProvider>
                   <MessageSearchStateProvider>
                     <ChatMentionContextProvider>
                       <FocusHandler />
                       <VisibilityHandler />
                       <PolicyAcknowledgmentHandler />
                       <PushNotificationsHandler />
                       <InviteLinkHandler />
                       <InviteLinksRefresher />
                       {content}
                     </ChatMentionContextProvider>
                   </MessageSearchStateProvider>
                 </TooltipProvider>
               </AlchemyENSCacheProvider>
             </WagmiConfig>
           </MenuProvider>
         </EditModalProvider>
       </DndProvider>
     );
   }
 
   onHeaderDoubleClick = (): void => electron?.doubleClickTopBar();
   stopDoubleClickPropagation: ?(SyntheticEvent<HTMLAnchorElement>) => void =
     electron ? e => e.stopPropagation() : null;
 
   renderLoginPage(): React.Node {
     const { loginMethod } = this.props.navInfo;
 
     if (loginMethod === 'qr-code') {
       return <QrCodeLogin />;
     }
 
     return <Splash />;
   }
 
   renderMainContent(): React.Node {
     const mainContent = this.getMainContentWithSwitcher();
 
     let navigationArrows = null;
     if (electron) {
       navigationArrows = <NavigationArrows />;
     }
 
     const headerClasses = classnames({
       [css.header]: true,
       [css['electron-draggable']]: electron,
     });
 
     const wordmarkClasses = classnames({
       [css.wordmark]: true,
       [css['electron-non-draggable']]: electron,
       [css['wordmark-macos']]: electron?.platform === 'macos',
     });
 
     return (
       <div className={css.layout}>
         <KeyserverReachabilityHandler />
         <DisconnectedBar />
         <UpdateModalHandler />
         <header
           className={headerClasses}
           onDoubleClick={this.onHeaderDoubleClick}
         >
           <div className={css['main-header']}>
             <h1 className={wordmarkClasses}>
               <a
                 title="Comm Home"
                 aria-label="Go to Comm Home"
                 onClick={this.onWordmarkClicked}
                 onDoubleClick={this.stopDoubleClickPropagation}
               >
                 Comm
               </a>
             </h1>
             {navigationArrows}
             <div className={css['upper-right']}>
               <LoadingIndicator
                 status={this.props.entriesLoadingStatus}
                 size="medium"
                 loadingClassName={css['page-loading']}
                 errorClassName={css['page-error']}
               />
             </div>
           </div>
         </header>
         <InputStateContainer>{mainContent}</InputStateContainer>
         <div className={css.sidebar}>
           <CommunityPicker />
         </div>
       </div>
     );
   }
 
   getMainContentWithSwitcher(): React.Node {
     const { tab, settingsSection } = this.props.navInfo;
     let mainContent: React.Node;
 
     if (tab === 'settings') {
       if (settingsSection === 'account') {
         mainContent = <AccountSettings />;
       } else if (settingsSection === 'friend-list') {
         mainContent = null;
       } else if (settingsSection === 'block-list') {
         mainContent = null;
       } else if (settingsSection === 'keyservers') {
         mainContent = <KeyserverSelectionList />;
       } else if (settingsSection === 'build-info') {
         mainContent = null;
       } else if (settingsSection === 'danger-zone') {
         mainContent = <DangerZone />;
       }
       return (
         <div className={css['main-content-container']}>
           <div className={css.switcher}>
             <SettingsSwitcher />
           </div>
           <div className={css['main-content']}>{mainContent}</div>
         </div>
       );
     }
 
     if (tab === 'calendar') {
       mainContent = <Calendar url={this.props.location.pathname} />;
     } else if (tab === 'chat') {
       mainContent = <Chat />;
     }
 
     const mainContentClass = classnames(
       css['main-content-container'],
       css['main-content-container-column'],
     );
     return (
       <div className={mainContentClass}>
         <Topbar />
         <div className={css['main-content']}>{mainContent}</div>
       </div>
     );
   }
 }
 
 const WEB_TUNNELBROKER_CHANNEL = new BroadcastChannel('shared-tunnelbroker');
 const WEB_TUNNELBROKER_MESSAGE_TYPES = Object.freeze({
   SEND_MESSAGE: 'send-message',
   MESSAGE_STATUS: 'message-status',
 });
 
 function useOtherTabsTunnelbrokerConnection(): SecondaryTunnelbrokerConnection {
   const onSendMessageCallbacks = React.useRef<
     Set<(MessageToDeviceRequest) => mixed>,
   >(new Set());
 
   const onMessageStatusCallbacks = React.useRef<
     Set<(messageID: string, error: ?string) => mixed>,
   >(new Set());
 
   React.useEffect(() => {
     const messageHandler = (event: MessageEvent) => {
       if (typeof event.data !== 'object' || !event.data) {
         console.log(
           'Invalid message received from shared ' +
             'tunnelbroker broadcast channel',
           event.data,
         );
         return;
       }
       const data = event.data;
       if (data.type === WEB_TUNNELBROKER_MESSAGE_TYPES.SEND_MESSAGE) {
         if (typeof data.message !== 'object' || !data.message) {
           console.log(
             'Invalid tunnelbroker message request received ' +
               'from shared tunnelbroker broadcast channel',
             event.data,
           );
           return;
         }
         // We know that the input was already validated
         const message: MessageToDeviceRequest = (data.message: any);
 
         for (const callback of onSendMessageCallbacks.current) {
           callback(message);
         }
       } else if (data.type === WEB_TUNNELBROKER_MESSAGE_TYPES.MESSAGE_STATUS) {
         if (typeof data.messageID !== 'string') {
           console.log(
             'Missing message id in message status message ' +
               'from shared tunnelbroker broadcast channel',
           );
           return;
         }
         const messageID = data.messageID;
 
         if (
           typeof data.error !== 'string' &&
           data.error !== null &&
           data.error !== undefined
         ) {
           console.log(
             'Invalid error in message status message ' +
               'from shared tunnelbroker broadcast channel',
             data.error,
           );
           return;
         }
         const error = data.error;
 
         for (const callback of onMessageStatusCallbacks.current) {
           callback(messageID, error);
         }
       } else {
         console.log(
           'Invalid message type ' +
             'from shared tunnelbroker broadcast channel',
           data,
         );
       }
     };
 
     WEB_TUNNELBROKER_CHANNEL.addEventListener('message', messageHandler);
     return () =>
       WEB_TUNNELBROKER_CHANNEL.removeEventListener('message', messageHandler);
   }, [onMessageStatusCallbacks, onSendMessageCallbacks]);
 
   return React.useMemo(
     () => ({
       sendMessage: message =>
         WEB_TUNNELBROKER_CHANNEL.postMessage({
           type: WEB_TUNNELBROKER_MESSAGE_TYPES.SEND_MESSAGE,
           message,
         }),
       onSendMessage: callback => {
         onSendMessageCallbacks.current.add(callback);
         return () => {
           onSendMessageCallbacks.current.delete(callback);
         };
       },
       setMessageStatus: (messageID, error) => {
         WEB_TUNNELBROKER_CHANNEL.postMessage({
           type: WEB_TUNNELBROKER_MESSAGE_TYPES.MESSAGE_STATUS,
           messageID,
           error,
         });
       },
       onMessageStatus: callback => {
         onMessageStatusCallbacks.current.add(callback);
         return () => {
           onMessageStatusCallbacks.current.delete(callback);
         };
       },
     }),
     [onMessageStatusCallbacks, onSendMessageCallbacks],
   );
 }
 
 const fetchEntriesLoadingStatusSelector = createLoadingStatusSelector(
   fetchEntriesActionTypes,
 );
 const updateCalendarQueryLoadingStatusSelector = createLoadingStatusSelector(
   updateCalendarQueryActionTypes,
 );
 
 const ConnectedApp: React.ComponentType<BaseProps> = React.memo<BaseProps>(
   function ConnectedApp(props) {
     const activeChatThreadID = useSelector(
       state => state.navInfo.activeChatThreadID,
     );
     const navInfo = useSelector(state => state.navInfo);
 
     const fetchEntriesLoadingStatus = useSelector(
       fetchEntriesLoadingStatusSelector,
     );
     const updateCalendarQueryLoadingStatus = useSelector(
       updateCalendarQueryLoadingStatusSelector,
     );
     const entriesLoadingStatus = combineLoadingStatuses(
       fetchEntriesLoadingStatus,
       updateCalendarQueryLoadingStatus,
     );
 
     const loggedIn = useSelector(isLoggedIn);
     const activeThreadCurrentlyUnread = useSelector(
       state =>
         !activeChatThreadID ||
         !!state.threadStore.threadInfos[activeChatThreadID]?.currentUser.unread,
     );
 
     useBadgeHandler();
 
     const dispatch = useDispatch();
     const modalContext = useModalContext();
     const modals = React.useMemo(
       () =>
         modalContext.modals.map(([modal, key]) => (
           <React.Fragment key={key}>{modal}</React.Fragment>
         )),
       [modalContext.modals],
     );
 
     const { lockStatus, releaseLockOrAbortRequest } = useWebLock(
       TUNNELBROKER_LOCK_NAME,
     );
 
     const secondaryTunnelbrokerConnection: SecondaryTunnelbrokerConnection =
       useOtherTabsTunnelbrokerConnection();
 
     return (
       <AppThemeWrapper>
         <TunnelbrokerProvider
           shouldBeClosed={lockStatus !== 'acquired'}
           onClose={releaseLockOrAbortRequest}
           secondaryTunnelbrokerConnection={secondaryTunnelbrokerConnection}
         >
           <IdentitySearchProvider>
             <App
               {...props}
               navInfo={navInfo}
               entriesLoadingStatus={entriesLoadingStatus}
               loggedIn={loggedIn}
               activeThreadCurrentlyUnread={activeThreadCurrentlyUnread}
               dispatch={dispatch}
               modals={modals}
             />
           </IdentitySearchProvider>
         </TunnelbrokerProvider>
       </AppThemeWrapper>
     );
   },
 );
 
 function AppWithProvider(props: BaseProps): React.Node {
   return (
     <ModalProvider>
       <ConnectedApp {...props} />
     </ModalProvider>
   );
 }
 
 export default AppWithProvider;
diff --git a/web/grpc/identity-service-client-wrapper.js b/web/grpc/identity-service-client-wrapper.js
index f48f4f196..ef30f57b7 100644
--- a/web/grpc/identity-service-client-wrapper.js
+++ b/web/grpc/identity-service-client-wrapper.js
@@ -1,634 +1,634 @@
 // @flow
 
 import { Login } from '@commapp/opaque-ke-wasm';
 
 import identityServiceConfig from 'lib/facts/identity-service.js';
 import type {
   OneTimeKeysResultValues,
   SignedPrekeys,
 } from 'lib/types/crypto-types.js';
 import type { PlatformDetails } from 'lib/types/device-types.js';
 import {
   type SignedDeviceList,
   signedDeviceListHistoryValidator,
   type SignedMessage,
   type IdentityServiceAuthLayer,
   type IdentityServiceClient,
   type DeviceOlmOutboundKeys,
   deviceOlmOutboundKeysValidator,
   type UserDevicesOlmOutboundKeys,
   type IdentityAuthResult,
   type IdentityNewDeviceKeyUpload,
   type IdentityExistingDeviceKeyUpload,
   identityDeviceTypes,
   identityAuthResultValidator,
   type UserDevicesOlmInboundKeys,
   type DeviceOlmInboundKeys,
   deviceOlmInboundKeysValidator,
   userDeviceOlmInboundKeysValidator,
 } from 'lib/types/identity-service-types.js';
 import { getMessageForException } from 'lib/utils/errors.js';
 import { assertWithValidator } from 'lib/utils/validation-utils.js';
 
 import { VersionInterceptor, AuthInterceptor } from './interceptor.js';
-import { initOpaque } from '../crypto/opaque-utils.js';
 import * as IdentityAuthClient from '../protobufs/identity-auth-client.cjs';
 import * as IdentityAuthStructs from '../protobufs/identity-auth-structs.cjs';
 import {
   DeviceKeyUpload,
   Empty,
   IdentityKeyInfo,
   OpaqueLoginFinishRequest,
   OpaqueLoginStartRequest,
   Prekey,
   WalletAuthRequest,
   SecondaryDeviceKeysUploadRequest,
 } from '../protobufs/identity-unauth-structs.cjs';
 import * as IdentityUnauthClient from '../protobufs/identity-unauth.cjs';
+import { initOpaque } from '../shared-worker/utils/opaque-utils.js';
 
 class IdentityServiceClientWrapper implements IdentityServiceClient {
-  overridedOpaqueFilepath: ?string;
+  overridedOpaqueFilepath: string;
   authClient: ?IdentityAuthClient.IdentityClientServicePromiseClient;
   unauthClient: IdentityUnauthClient.IdentityClientServicePromiseClient;
   getNewDeviceKeyUpload: () => Promise<IdentityNewDeviceKeyUpload>;
   getExistingDeviceKeyUpload: () => Promise<IdentityExistingDeviceKeyUpload>;
 
   constructor(
     platformDetails: PlatformDetails,
-    overridedOpaqueFilepath: ?string,
+    overridedOpaqueFilepath: string,
     authLayer: ?IdentityServiceAuthLayer,
     getNewDeviceKeyUpload: () => Promise<IdentityNewDeviceKeyUpload>,
     getExistingDeviceKeyUpload: () => Promise<IdentityExistingDeviceKeyUpload>,
   ) {
     this.overridedOpaqueFilepath = overridedOpaqueFilepath;
     if (authLayer) {
       this.authClient = IdentityServiceClientWrapper.createAuthClient(
         platformDetails,
         authLayer,
       );
     }
     this.unauthClient =
       IdentityServiceClientWrapper.createUnauthClient(platformDetails);
     this.getNewDeviceKeyUpload = getNewDeviceKeyUpload;
     this.getExistingDeviceKeyUpload = getExistingDeviceKeyUpload;
   }
 
   static determineSocketAddr(): string {
     return process.env.IDENTITY_SOCKET_ADDR ?? identityServiceConfig.defaultURL;
   }
 
   static createAuthClient(
     platformDetails: PlatformDetails,
     authLayer: IdentityServiceAuthLayer,
   ): IdentityAuthClient.IdentityClientServicePromiseClient {
     const { userID, deviceID, commServicesAccessToken } = authLayer;
 
     const identitySocketAddr =
       IdentityServiceClientWrapper.determineSocketAddr();
 
     const versionInterceptor = new VersionInterceptor<Request, Response>(
       platformDetails,
     );
     const authInterceptor = new AuthInterceptor<Request, Response>(
       userID,
       deviceID,
       commServicesAccessToken,
     );
 
     const authClientOpts = {
       unaryInterceptors: [versionInterceptor, authInterceptor],
     };
 
     return new IdentityAuthClient.IdentityClientServicePromiseClient(
       identitySocketAddr,
       null,
       authClientOpts,
     );
   }
 
   static createUnauthClient(
     platformDetails: PlatformDetails,
   ): IdentityUnauthClient.IdentityClientServicePromiseClient {
     const identitySocketAddr =
       IdentityServiceClientWrapper.determineSocketAddr();
 
     const versionInterceptor = new VersionInterceptor<Request, Response>(
       platformDetails,
     );
 
     const unauthClientOpts = {
       unaryInterceptors: [versionInterceptor],
     };
 
     return new IdentityUnauthClient.IdentityClientServicePromiseClient(
       identitySocketAddr,
       null,
       unauthClientOpts,
     );
   }
 
   deleteUser: () => Promise<void> = async () => {
     if (!this.authClient) {
       throw new Error('Identity service client is not initialized');
     }
     await this.authClient.deleteUser(new Empty());
   };
 
   logOut: () => Promise<void> = async () => {
     if (!this.authClient) {
       throw new Error('Identity service client is not initialized');
     }
     await this.authClient.logOutUser(new Empty());
   };
 
   getKeyserverKeys: (keyserverID: string) => Promise<DeviceOlmOutboundKeys> =
     async (keyserverID: string) => {
       const client = this.authClient;
       if (!client) {
         throw new Error('Identity service client is not initialized');
       }
 
       const request = new IdentityAuthStructs.OutboundKeysForUserRequest();
       request.setUserId(keyserverID);
       const response = await client.getKeyserverKeys(request);
 
       const keyserverInfo = response.getKeyserverInfo();
       const identityInfo = keyserverInfo?.getIdentityInfo();
       const contentPreKey = keyserverInfo?.getContentPrekey();
       const notifPreKey = keyserverInfo?.getNotifPrekey();
       const payload = identityInfo?.getPayload();
 
       const keyserverKeys = {
         identityKeysBlob: payload ? JSON.parse(payload) : null,
         contentInitializationInfo: {
           prekey: contentPreKey?.getPrekey(),
           prekeySignature: contentPreKey?.getPrekeySignature(),
           oneTimeKey: keyserverInfo?.getOneTimeContentPrekey(),
         },
         notifInitializationInfo: {
           prekey: notifPreKey?.getPrekey(),
           prekeySignature: notifPreKey?.getPrekeySignature(),
           oneTimeKey: keyserverInfo?.getOneTimeNotifPrekey(),
         },
         payloadSignature: identityInfo?.getPayloadSignature(),
         socialProof: identityInfo?.getSocialProof(),
       };
 
       if (!keyserverKeys.contentInitializationInfo.oneTimeKey) {
         throw new Error('Missing content one time key');
       }
       if (!keyserverKeys.notifInitializationInfo.oneTimeKey) {
         throw new Error('Missing notif one time key');
       }
 
       return assertWithValidator(keyserverKeys, deviceOlmOutboundKeysValidator);
     };
 
   getOutboundKeysForUser: (
     userID: string,
   ) => Promise<UserDevicesOlmOutboundKeys[]> = async (userID: string) => {
     const client = this.authClient;
     if (!client) {
       throw new Error('Identity service client is not initialized');
     }
 
     const request = new IdentityAuthStructs.OutboundKeysForUserRequest();
     request.setUserId(userID);
     const response = await client.getOutboundKeysForUser(request);
     const devicesMap = response.toObject()?.devicesMap;
 
     if (!devicesMap || !Array.isArray(devicesMap)) {
       throw new Error('Invalid devicesMap');
     }
 
     const devicesKeys: (?UserDevicesOlmOutboundKeys)[] = devicesMap.map(
       ([deviceID, outboundKeysInfo]) => {
         const identityInfo = outboundKeysInfo?.identityInfo;
         const payload = identityInfo?.payload;
         const contentPreKey = outboundKeysInfo?.contentPrekey;
         const notifPreKey = outboundKeysInfo?.notifPrekey;
 
         if (typeof deviceID !== 'string') {
           console.log(`Invalid deviceID in devicesMap: ${deviceID}`);
           return null;
         }
 
         if (
           !outboundKeysInfo.oneTimeContentPrekey ||
           !outboundKeysInfo.oneTimeNotifPrekey
         ) {
           console.log(`Missing one time key for device ${deviceID}`);
           return {
             deviceID,
             keys: null,
           };
         }
 
         const deviceKeys = {
           identityKeysBlob: payload ? JSON.parse(payload) : null,
           contentInitializationInfo: {
             prekey: contentPreKey?.prekey,
             prekeySignature: contentPreKey?.prekeySignature,
             oneTimeKey: outboundKeysInfo.oneTimeContentPrekey,
           },
           notifInitializationInfo: {
             prekey: notifPreKey?.prekey,
             prekeySignature: notifPreKey?.prekeySignature,
             oneTimeKey: outboundKeysInfo.oneTimeNotifPrekey,
           },
           payloadSignature: identityInfo?.payloadSignature,
           socialProof: identityInfo?.socialProof,
         };
 
         try {
           const validatedKeys = assertWithValidator(
             deviceKeys,
             deviceOlmOutboundKeysValidator,
           );
           return {
             deviceID,
             keys: validatedKeys,
           };
         } catch (e) {
           console.log(e);
           return {
             deviceID,
             keys: null,
           };
         }
       },
     );
 
     return devicesKeys.filter(Boolean);
   };
 
   getInboundKeysForUser: (
     userID: string,
   ) => Promise<UserDevicesOlmInboundKeys> = async (userID: string) => {
     const client = this.authClient;
     if (!client) {
       throw new Error('Identity service client is not initialized');
     }
 
     const request = new IdentityAuthStructs.InboundKeysForUserRequest();
     request.setUserId(userID);
     const response = await client.getInboundKeysForUser(request);
     const devicesMap = response.toObject()?.devicesMap;
 
     if (!devicesMap || !Array.isArray(devicesMap)) {
       throw new Error('Invalid devicesMap');
     }
 
     const devicesKeys: {
       [deviceID: string]: ?DeviceOlmInboundKeys,
     } = {};
 
     devicesMap.forEach(([deviceID, inboundKeys]) => {
       const identityInfo = inboundKeys?.identityInfo;
       const payload = identityInfo?.payload;
       const contentPreKey = inboundKeys?.contentPrekey;
       const notifPreKey = inboundKeys?.notifPrekey;
 
       if (typeof deviceID !== 'string') {
         console.log(`Invalid deviceID in devicesMap: ${deviceID}`);
         return;
       }
 
       const deviceKeys = {
         identityKeysBlob: payload ? JSON.parse(payload) : null,
         signedPrekeys: {
           contentPrekey: contentPreKey?.prekey,
           contentPrekeySignature: contentPreKey?.prekeySignature,
           notifPrekey: notifPreKey?.prekey,
           notifPrekeySignature: notifPreKey?.prekeySignature,
         },
         payloadSignature: identityInfo?.payloadSignature,
       };
 
       try {
         devicesKeys[deviceID] = assertWithValidator(
           deviceKeys,
           deviceOlmInboundKeysValidator,
         );
       } catch (e) {
         console.log(e);
         devicesKeys[deviceID] = null;
       }
     });
 
     const identityInfo = response?.getIdentity();
     const inboundUserKeys = {
       keys: devicesKeys,
       username: identityInfo?.getUsername(),
       walletAddress: identityInfo?.getEthIdentity()?.getWalletAddress(),
     };
 
     return assertWithValidator(
       inboundUserKeys,
       userDeviceOlmInboundKeysValidator,
     );
   };
 
   uploadOneTimeKeys: (oneTimeKeys: OneTimeKeysResultValues) => Promise<void> =
     async (oneTimeKeys: OneTimeKeysResultValues) => {
       const client = this.authClient;
       if (!client) {
         throw new Error('Identity service client is not initialized');
       }
 
       const contentOneTimeKeysArray = [...oneTimeKeys.contentOneTimeKeys];
       const notifOneTimeKeysArray = [...oneTimeKeys.notificationsOneTimeKeys];
 
       const request = new IdentityAuthStructs.UploadOneTimeKeysRequest();
       request.setContentOneTimePrekeysList(contentOneTimeKeysArray);
       request.setNotifOneTimePrekeysList(notifOneTimeKeysArray);
       await client.uploadOneTimeKeys(request);
     };
 
   logInPasswordUser: (
     username: string,
     password: string,
   ) => Promise<IdentityAuthResult> = async (
     username: string,
     password: string,
   ) => {
     const client = this.unauthClient;
     if (!client) {
       throw new Error('Identity service client is not initialized');
     }
 
     const [identityDeviceKeyUpload] = await Promise.all([
       this.getExistingDeviceKeyUpload(),
       initOpaque(this.overridedOpaqueFilepath),
     ]);
 
     const opaqueLogin = new Login();
     const startRequestBytes = opaqueLogin.start(password);
 
     const deviceKeyUpload = authExistingDeviceKeyUpload(
       identityDeviceKeyUpload,
     );
 
     const loginStartRequest = new OpaqueLoginStartRequest();
     loginStartRequest.setUsername(username);
     loginStartRequest.setOpaqueLoginRequest(startRequestBytes);
     loginStartRequest.setDeviceKeyUpload(deviceKeyUpload);
 
     let loginStartResponse;
     try {
       loginStartResponse =
         await client.logInPasswordUserStart(loginStartRequest);
     } catch (e) {
       console.log('Error calling logInPasswordUserStart:', e);
       throw new Error(getMessageForException(e) ?? 'unknown');
     }
     const finishRequestBytes = opaqueLogin.finish(
       loginStartResponse.getOpaqueLoginResponse_asU8(),
     );
 
     const loginFinishRequest = new OpaqueLoginFinishRequest();
     loginFinishRequest.setSessionId(loginStartResponse.getSessionId());
     loginFinishRequest.setOpaqueLoginUpload(finishRequestBytes);
 
     let loginFinishResponse;
     try {
       loginFinishResponse =
         await client.logInPasswordUserFinish(loginFinishRequest);
     } catch (e) {
       console.log('Error calling logInPasswordUserFinish:', e);
       throw new Error(getMessageForException(e) ?? 'unknown');
     }
 
     const userID = loginFinishResponse.getUserId();
     const accessToken = loginFinishResponse.getAccessToken();
     const identityAuthResult = { accessToken, userID, username };
 
     return assertWithValidator(identityAuthResult, identityAuthResultValidator);
   };
 
   logInWalletUser: (
     walletAddress: string,
     siweMessage: string,
     siweSignature: string,
   ) => Promise<IdentityAuthResult> = async (
     walletAddress: string,
     siweMessage: string,
     siweSignature: string,
   ) => {
     const identityDeviceKeyUpload = await this.getExistingDeviceKeyUpload();
     const deviceKeyUpload = authExistingDeviceKeyUpload(
       identityDeviceKeyUpload,
     );
 
     const loginRequest = new WalletAuthRequest();
     loginRequest.setSiweMessage(siweMessage);
     loginRequest.setSiweSignature(siweSignature);
     loginRequest.setDeviceKeyUpload(deviceKeyUpload);
 
     let loginResponse;
     try {
       loginResponse = await this.unauthClient.logInWalletUser(loginRequest);
     } catch (e) {
       console.log('Error calling logInWalletUser:', e);
       throw new Error(getMessageForException(e) ?? 'unknown');
     }
 
     const userID = loginResponse.getUserId();
     const accessToken = loginResponse.getAccessToken();
     const identityAuthResult = { accessToken, userID, username: walletAddress };
 
     return assertWithValidator(identityAuthResult, identityAuthResultValidator);
   };
 
   uploadKeysForRegisteredDeviceAndLogIn: (
     ownerUserID: string,
     nonceChallengeResponse: SignedMessage,
   ) => Promise<IdentityAuthResult> = async (
     ownerUserID,
     nonceChallengeResponse,
   ) => {
     const identityDeviceKeyUpload = await this.getNewDeviceKeyUpload();
     const deviceKeyUpload = authNewDeviceKeyUpload(identityDeviceKeyUpload);
     const challengeResponse = JSON.stringify(nonceChallengeResponse);
 
     const request = new SecondaryDeviceKeysUploadRequest();
     request.setUserId(ownerUserID);
     request.setChallengeResponse(challengeResponse);
     request.setDeviceKeyUpload(deviceKeyUpload);
 
     let response;
     try {
       response =
         await this.unauthClient.uploadKeysForRegisteredDeviceAndLogIn(request);
     } catch (e) {
       console.log('Error calling uploadKeysForRegisteredDeviceAndLogIn:', e);
       throw new Error(getMessageForException(e) ?? 'unknown');
     }
 
     const userID = response.getUserId();
     const accessToken = response.getAccessToken();
     const identityAuthResult = { accessToken, userID, username: '' };
 
     return assertWithValidator(identityAuthResult, identityAuthResultValidator);
   };
 
   generateNonce: () => Promise<string> = async () => {
     const result = await this.unauthClient.generateNonce(new Empty());
     return result.getNonce();
   };
 
   publishWebPrekeys: (prekeys: SignedPrekeys) => Promise<void> = async (
     prekeys: SignedPrekeys,
   ) => {
     const client = this.authClient;
     if (!client) {
       throw new Error('Identity service client is not initialized');
     }
 
     const contentPrekeyUpload = new Prekey();
     contentPrekeyUpload.setPrekey(prekeys.contentPrekey);
     contentPrekeyUpload.setPrekeySignature(prekeys.contentPrekeySignature);
 
     const notifPrekeyUpload = new Prekey();
     notifPrekeyUpload.setPrekey(prekeys.notifPrekey);
     notifPrekeyUpload.setPrekeySignature(prekeys.notifPrekeySignature);
 
     const request = new IdentityAuthStructs.RefreshUserPrekeysRequest();
     request.setNewContentPrekeys(contentPrekeyUpload);
     request.setNewNotifPrekeys(notifPrekeyUpload);
     await client.refreshUserPrekeys(request);
   };
 
   getDeviceListHistoryForUser: (
     userID: string,
     sinceTimestamp?: number,
   ) => Promise<$ReadOnlyArray<SignedDeviceList>> = async (
     userID,
     sinceTimestamp,
   ) => {
     const client = this.authClient;
     if (!client) {
       throw new Error('Identity service client is not initialized');
     }
     const request = new IdentityAuthStructs.GetDeviceListRequest();
     request.setUserId(userID);
     if (sinceTimestamp) {
       request.setSinceTimestamp(sinceTimestamp);
     }
     const response = await client.getDeviceListForUser(request);
     const rawPayloads = response.getDeviceListUpdatesList();
     const deviceListUpdates: SignedDeviceList[] = rawPayloads.map(payload =>
       JSON.parse(payload),
     );
     return assertWithValidator(
       deviceListUpdates,
       signedDeviceListHistoryValidator,
     );
   };
 }
 
 function authNewDeviceKeyUpload(
   uploadData: IdentityNewDeviceKeyUpload,
 ): DeviceKeyUpload {
   const {
     keyPayload,
     keyPayloadSignature,
     contentPrekey,
     contentPrekeySignature,
     notifPrekey,
     notifPrekeySignature,
     contentOneTimeKeys,
     notifOneTimeKeys,
   } = uploadData;
 
   const identityKeyInfo = createIdentityKeyInfo(
     keyPayload,
     keyPayloadSignature,
   );
 
   const contentPrekeyUpload = createPrekey(
     contentPrekey,
     contentPrekeySignature,
   );
 
   const notifPrekeyUpload = createPrekey(notifPrekey, notifPrekeySignature);
 
   const deviceKeyUpload = createDeviceKeyUpload(
     identityKeyInfo,
     contentPrekeyUpload,
     notifPrekeyUpload,
     contentOneTimeKeys,
     notifOneTimeKeys,
   );
 
   return deviceKeyUpload;
 }
 
 function authExistingDeviceKeyUpload(
   uploadData: IdentityExistingDeviceKeyUpload,
 ): DeviceKeyUpload {
   const {
     keyPayload,
     keyPayloadSignature,
     contentPrekey,
     contentPrekeySignature,
     notifPrekey,
     notifPrekeySignature,
   } = uploadData;
 
   const identityKeyInfo = createIdentityKeyInfo(
     keyPayload,
     keyPayloadSignature,
   );
 
   const contentPrekeyUpload = createPrekey(
     contentPrekey,
     contentPrekeySignature,
   );
 
   const notifPrekeyUpload = createPrekey(notifPrekey, notifPrekeySignature);
 
   const deviceKeyUpload = createDeviceKeyUpload(
     identityKeyInfo,
     contentPrekeyUpload,
     notifPrekeyUpload,
   );
 
   return deviceKeyUpload;
 }
 
 function createIdentityKeyInfo(
   keyPayload: string,
   keyPayloadSignature: string,
 ): IdentityKeyInfo {
   const identityKeyInfo = new IdentityKeyInfo();
   identityKeyInfo.setPayload(keyPayload);
   identityKeyInfo.setPayloadSignature(keyPayloadSignature);
   return identityKeyInfo;
 }
 
 function createPrekey(prekey: string, prekeySignature: string): Prekey {
   const prekeyUpload = new Prekey();
   prekeyUpload.setPrekey(prekey);
   prekeyUpload.setPrekeySignature(prekeySignature);
   return prekeyUpload;
 }
 
 function createDeviceKeyUpload(
   identityKeyInfo: IdentityKeyInfo,
   contentPrekeyUpload: Prekey,
   notifPrekeyUpload: Prekey,
   contentOneTimeKeys: $ReadOnlyArray<string> = [],
   notifOneTimeKeys: $ReadOnlyArray<string> = [],
 ): DeviceKeyUpload {
   const deviceKeyUpload = new DeviceKeyUpload();
   deviceKeyUpload.setDeviceKeyInfo(identityKeyInfo);
   deviceKeyUpload.setContentUpload(contentPrekeyUpload);
   deviceKeyUpload.setNotifUpload(notifPrekeyUpload);
   deviceKeyUpload.setOneTimeContentPrekeysList([...contentOneTimeKeys]);
   deviceKeyUpload.setOneTimeNotifPrekeysList([...notifOneTimeKeys]);
   deviceKeyUpload.setDeviceType(identityDeviceTypes.WEB);
   return deviceKeyUpload;
 }
 
 export { IdentityServiceClientWrapper };
diff --git a/web/crypto/opaque-utils.js b/web/shared-worker/utils/opaque-utils.js
similarity index 57%
rename from web/crypto/opaque-utils.js
rename to web/shared-worker/utils/opaque-utils.js
index 86d289791..cbe2ec11f 100644
--- a/web/crypto/opaque-utils.js
+++ b/web/shared-worker/utils/opaque-utils.js
@@ -1,20 +1,17 @@
 // @flow
 
 import initOpaqueKe from '@commapp/opaque-ke-wasm';
 
-declare var opaqueURL: string;
-
 let opaqueKeLoadingState: void | true | Promise<mixed>;
 
-function initOpaque(overrideOpaqueURL?: ?string): Promise<mixed> {
-  const finalOpaqueURL = overrideOpaqueURL ?? opaqueURL;
+function initOpaque(opaqueURL: string): Promise<mixed> {
   if (opaqueKeLoadingState === true) {
     return Promise.resolve();
   }
   if (!opaqueKeLoadingState) {
-    opaqueKeLoadingState = initOpaqueKe(finalOpaqueURL);
+    opaqueKeLoadingState = initOpaqueKe(opaqueURL);
   }
   return opaqueKeLoadingState;
 }
 
 export { initOpaque };
diff --git a/web/shared-worker/worker/identity-client.js b/web/shared-worker/worker/identity-client.js
index d12cdb42d..7bf53f7c7 100644
--- a/web/shared-worker/worker/identity-client.js
+++ b/web/shared-worker/worker/identity-client.js
@@ -1,69 +1,71 @@
 // @flow
 
 import type { PlatformDetails } from 'lib/types/device-types.js';
 
 import {
   getNewDeviceKeyUpload,
   getExistingDeviceKeyUpload,
 } from './worker-crypto.js';
 import { IdentityServiceClientWrapper } from '../../grpc/identity-service-client-wrapper.js';
 import {
   type WorkerResponseMessage,
   type WorkerRequestMessage,
   workerRequestMessageTypes,
   workerResponseMessageTypes,
 } from '../../types/worker-types.js';
 import type { EmscriptenModule } from '../types/module.js';
 import type { SQLiteQueryExecutor } from '../types/sqlite-query-executor.js';
+import { initOpaque } from '../utils/opaque-utils.js';
 
 let identityClient: ?IdentityServiceClientWrapper = null;
 
 async function processAppIdentityClientRequest(
   sqliteQueryExecutor: SQLiteQueryExecutor,
   dbModule: EmscriptenModule,
   platformDetails: PlatformDetails,
   message: WorkerRequestMessage,
 ): Promise<?WorkerResponseMessage> {
   if (
     message.type === workerRequestMessageTypes.CREATE_IDENTITY_SERVICE_CLIENT
   ) {
+    void initOpaque(message.opaqueWasmPath);
     identityClient = new IdentityServiceClientWrapper(
       platformDetails,
       message.opaqueWasmPath,
       message.authLayer,
       async () => getNewDeviceKeyUpload(),
       async () => getExistingDeviceKeyUpload(),
     );
     return undefined;
   }
 
   if (!identityClient) {
     throw new Error('Identity client not created');
   }
 
   if (message.type === workerRequestMessageTypes.CALL_IDENTITY_CLIENT_METHOD) {
     // Flow doesn't allow us to access methods like this (it needs an index
     // signature declaration in the object type)
     const method: (...$ReadOnlyArray<mixed>) => mixed = (identityClient: any)[
       message.method
     ];
     if (typeof method !== 'function') {
       throw new Error(
         `Couldn't find identity client method with name '${message.method}'`,
       );
     }
     const result = await method(...message.args);
     return {
       type: workerResponseMessageTypes.CALL_IDENTITY_CLIENT_METHOD,
       result,
     };
   }
 
   return undefined;
 }
 
 function getIdentityClient(): ?IdentityServiceClientWrapper {
   return identityClient;
 }
 
 export { processAppIdentityClientRequest, getIdentityClient };
diff --git a/web/webpack.config.cjs b/web/webpack.config.cjs
index 517b48215..7b79dee01 100644
--- a/web/webpack.config.cjs
+++ b/web/webpack.config.cjs
@@ -1,282 +1,262 @@
 const CopyPlugin = require('copy-webpack-plugin');
 const path = require('path');
 const { WebpackManifestPlugin } = require('webpack-manifest-plugin');
 
 const {
   createProdBrowserConfig,
   createDevBrowserConfig,
   createNodeServerRenderingConfig,
   createWebWorkersConfig,
 } = require('lib/webpack/shared.cjs');
 
 const babelConfig = require('./.babelrc.cjs');
 
 async function getConfig(configName) {
   const { getCommConfig } = await import(
     'keyserver/dist/lib/utils/comm-config.js'
   );
   return await getCommConfig(configName);
 }
 
 const baseBrowserConfig = {
   entry: {
     browser: ['./script.js'],
   },
   output: {
     filename: 'prod.[contenthash:12].build.js',
     path: path.join(__dirname, 'dist'),
   },
   resolve: {
     alias: {
       '../images': path.resolve('../keyserver/images'),
     },
     fallback: {
       crypto: false,
       fs: false,
       path: false,
     },
   },
 };
 
 const baseDevBrowserConfig = {
   ...baseBrowserConfig,
   output: {
     ...baseBrowserConfig.output,
     filename: 'dev.build.js',
     pathinfo: true,
     publicPath: 'http://localhost:8080/',
   },
   devServer: {
     port: 8080,
     headers: { 'Access-Control-Allow-Origin': '*' },
     allowedHosts: ['all'],
     host: '0.0.0.0',
     static: {
       directory: path.join(__dirname, 'dist'),
     },
   },
   plugins: [
     new CopyPlugin({
       patterns: [
         {
           from: 'node_modules/@commapp/olm/olm.wasm',
           to: path.join(__dirname, 'dist'),
         },
       ],
     }),
-    new CopyPlugin({
-      patterns: [
-        {
-          from:
-            'node_modules/@commapp/opaque-ke-wasm' +
-            '/pkg/comm_opaque2_wasm_bg.wasm',
-          to: path.join(__dirname, 'dist', 'opaque-ke.wasm'),
-        },
-      ],
-    }),
   ],
 };
 
 const baseProdBrowserConfig = {
   ...baseBrowserConfig,
   plugins: [
     new CopyPlugin({
       patterns: [
         {
           from: 'node_modules/@commapp/olm/olm.wasm',
           to: path.join(__dirname, 'dist', 'olm.[contenthash:12].wasm'),
         },
       ],
     }),
-    new CopyPlugin({
-      patterns: [
-        {
-          from:
-            'node_modules/@commapp/opaque-ke-wasm' +
-            '/pkg/comm_opaque2_wasm_bg.wasm',
-          to: path.join(__dirname, 'dist', 'opaque-ke.[contenthash:12].wasm'),
-        },
-      ],
-    }),
     new WebpackManifestPlugin({
       publicPath: '',
     }),
   ],
 };
 
 const baseNodeServerRenderingConfig = {
   externals: ['react', 'react-dom', 'react-redux'],
   entry: {
     keyserver: ['./loading.react.js'],
   },
   output: {
     filename: 'app.build.cjs',
     library: 'app',
     libraryTarget: 'commonjs2',
     path: path.join(__dirname, 'dist'),
   },
 };
 
 const baseWebWorkersConfig = {
   entry: {
     pushNotif: './push-notif/service-worker.js',
     database: './shared-worker/worker/shared-worker.js',
   },
   output: {
     filename: '[name].build.js',
     path: path.join(__dirname, 'dist', 'webworkers'),
   },
   resolve: {
     fallback: {
       crypto: false,
       fs: false,
       path: false,
     },
   },
 };
 
 const devWebWorkersPlugins = [
   new CopyPlugin({
     patterns: [
       {
         from: 'shared-worker/_generated/comm_query_executor.wasm',
         to: path.join(__dirname, 'dist', 'webworkers'),
       },
     ],
   }),
   new CopyPlugin({
     patterns: [
       {
         from: 'node_modules/@commapp/olm/olm.wasm',
         to: path.join(__dirname, 'dist', 'webworkers'),
       },
     ],
   }),
   new CopyPlugin({
     patterns: [
       {
         from: 'backup-client-wasm/wasm/backup-client-wasm_bg.wasm',
         to: path.join(__dirname, 'dist', 'webworkers'),
       },
     ],
   }),
   new CopyPlugin({
     patterns: [
       {
         from:
           'node_modules/@commapp/opaque-ke-wasm' +
           '/pkg/comm_opaque2_wasm_bg.wasm',
         to: path.join(__dirname, 'dist', 'webworkers'),
       },
     ],
   }),
 ];
 
 const prodWebWorkersPlugins = [
   new CopyPlugin({
     patterns: [
       {
         from: 'shared-worker/_generated/comm_query_executor.wasm',
         to: path.join(
           __dirname,
           'dist',
           'webworkers',
           'comm_query_executor.[contenthash:12].wasm',
         ),
       },
     ],
   }),
   new CopyPlugin({
     patterns: [
       {
         from: 'node_modules/@commapp/olm/olm.wasm',
         to: path.join(
           __dirname,
           'dist',
           'webworkers',
           'olm.[contenthash:12].wasm',
         ),
       },
     ],
   }),
   new CopyPlugin({
     patterns: [
       {
         from: 'backup-client-wasm/wasm/backup-client-wasm_bg.wasm',
         to: path.join(
           __dirname,
           'dist',
           'webworkers',
           'backup-client.[contenthash:12].wasm',
         ),
       },
     ],
   }),
   new CopyPlugin({
     patterns: [
       {
         from:
           'node_modules/@commapp/opaque-ke-wasm' +
           '/pkg/comm_opaque2_wasm_bg.wasm',
         to: path.join(
           __dirname,
           'dist',
           'webworkers',
           'opaque-ke.[contenthash:12].wasm',
         ),
       },
     ],
   }),
   new WebpackManifestPlugin({
     publicPath: '',
   }),
 ];
 
 module.exports = async function (env) {
   const identityServiceConfig = await getConfig({
     folder: 'secrets',
     name: 'identity_service_config',
   });
   const identitySocketAddr = JSON.stringify(
     identityServiceConfig?.identitySocketAddr,
   );
   const authoritativeKeyserverIDConfig = await getConfig({
     folder: 'facts',
     name: 'authoritative_keyserver',
   });
   const authoritativeKeyserverID = JSON.stringify(
     authoritativeKeyserverIDConfig?.authoritativeKeyserverID,
   );
 
   const envVars = {
     IDENTITY_SOCKET_ADDR: identitySocketAddr,
     AUTHORITATIVE_KEYSERVER_ID: authoritativeKeyserverID,
   };
   const browserConfigPromise = env.prod
     ? createProdBrowserConfig(baseProdBrowserConfig, babelConfig, envVars)
     : createDevBrowserConfig(baseDevBrowserConfig, babelConfig, envVars);
   const nodeConfigPromise = createNodeServerRenderingConfig(
     baseNodeServerRenderingConfig,
     babelConfig,
   );
   const [browserConfig, nodeConfig] = await Promise.all([
     browserConfigPromise,
     nodeConfigPromise,
   ]);
 
   const nodeServerRenderingConfig = {
     ...nodeConfig,
     mode: env.prod ? 'production' : 'development',
   };
 
   const workersConfig = {
     ...baseWebWorkersConfig,
     plugins: env.prod ? prodWebWorkersPlugins : devWebWorkersPlugins,
   };
   const webWorkersConfig = createWebWorkersConfig(
     env,
     workersConfig,
     babelConfig,
   );
   return [browserConfig, nodeServerRenderingConfig, webWorkersConfig];
 };