riot.im seems to tick all of the open source and encryption checklist from a quick inspection. The only thing I have against it is that the linux client is an electron app. The tox client by comparison is native GTK, which is a much smaller codebase to attack, quicker to launch and much more pleasant to use, just a shame tox's implementation of groups is non sticky.