It seems robust, but I do worry about the client. Has the client been audited properly? I hope the track record's not like Pidgin's https://pidgin.im/news/security/
That's too bad, pidgin is the only client I want to use, regardless of the protocol...