A browser-based chat where the messages are encrypted in the browser so that only the conversation participants can see the messages but not the server, it's just storing them. The messages would be encoded by AES and the key exchange can be done with RSA. The database would store the encription key for every user for every conversation but encrypted with for example the user's password or RSA private key, and the pr…
Supports multiparty OTR, etc.
Server doesn't see message contents. Ephemeral key exchange via OTR (hence supports perfect forward secrecy), though of course there's always the problem of trusting the fingerprint, i.e. someone (e.g. the server) can just MitM the whole thing.
So ideally, one should verify the OTR fingerprints of the other parties via some secondary channel.
You can also run the server on your own infrastructure.
P.S.
> key exchange can be done with RSA
any particular reason for RSA, and not ECDH key exchange?