Looking for feedback on the cryptographic design of my open source project: Bloom I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption.

I've published the cryptographic details online and I am looking for feedback by the community before launching it:

https://gitlab.com/bloom42/bloom/-/wikis/security

Any feedback is welcome.
One obvious note is that if someone (possibly someone posing as a server) overhears the client to server message (that is, the client's input to the crypto.verify.password_hash.argon2id function), then he knows enough to register as the client to a valid server.  He might not know the password; however he wouldn't need to.

If that is a problem, it would sound like you need some sort of authenticated key exchange (perhaps Opaque), which addresses this.  And, no, I don't happen to have an implementation of that handy...