Why not use a HYBRID encryption with ECDH x25519 and Argon2 for user password? That way, no need to store any private key because the private key would always come from the Argon2 password input (and if the Argon2 params are heavy, and since salt if different each time, this password can be extremely simple).
I wrote a backup tool for Linux where I used this technique, here's the encryption diagram:
florian.club/pub/scripts/bac…
The "Archive" in my diagram would be the chat message in this case, where the Argon2 params (including salt) and the Ephemeral key are saved along with the encrypted data.
Then no need HSMs, because the private key is nowhere, it's simply generated upon password Argon2 and happens to produce the same symmetric key that was generated during encryption due to the commutative propriety of ECDH that says Prv1 Pub2 = Prv2 Pub1.
In the case of my diagram that symmetric key is then used for Chacha20-poly1305.
In the end, no private key is ever stored, it is always generated, is different every time, but happens to generate the same key to be used for the asymmetric encryption.
Also, since modern browsers and (likely phones too I assume?) support Argon2, then even the server itself would never hold the actual password in memory, but only the other keys which only work for one message due to salt.
@elonmusk @x @chat