For the last six months the Automerge team has been working on implementing end-to-end encryption and access control for local first applications as part of the Keyhive project. Part of this work has been designing a mechanism for synchronising end-to-end-encrypted CRDTs - a sub-project we have called "Beelay". In this talk I'll explain how the introduction of end-to-end encryption makes sync much more complicated, and some details of the solution we've landed on before talking about the status and future of the project.