I started this because I was working on a Discord music bot using disgo. Discord added DAVE (their E2E encryption for voice) and the only Go option was wrapping libdave via CGo. Cross-compilation was a mess so I implemented DAVE directly in Go, which meant implementing MLS first.

The RFC is 180 pages. Took about 9 months.

https://github.com/thomas-vilte/mls-go

Passes the RFC 9420 test vectors and cross-interops against mlspp (Cisco) and OpenMLS (Rust). Also built dave-go on top of it: https://github.com/thomas-vilte/dave-go

One thing that was interesting: HPKE encryptions across the copath during a commit are independent, so they run in parallel — one goroutine per level, tree mutation stays sequential.

CS4 (P-521) is still missing, blocked on a stdlib issue.