The two questions every secrets system must answer¶
Strip away the marketing and every system is answering exactly two questions:
Who can decrypt? Purely a matter of cryptography: who holds a key that mathematically works.
Who can change the rules about who can decrypt? A matter of authority: who is allowed to add a member, remove one, or publish a new value.
Confusing the two is the classic mistake. A system that answers the second question with "the server decides" has quietly made the server able to answer the first one too. Keep these separate in your head and the next part will make sense immediately.