> It seems clear that there has to be a single key, rather than separate keys for each pair of participants, since in a large meeting we need all video streams running through a server and everyone receiving the same streams, for manageable upload bandwidth.

Why is this the case? Watching streams on Twitch or YouTube with HTTPS are all encrypted individually for each connection. It's not like TV or radio where you have to broadcast the same thing to everyone.

> But therefore... as long as you're trusting the server with key distribution/management in the first place... don't you necessarily have to simply trust that the server isn't peeking?

I think you're right that you'll need to trust key distribution. Some companies might actually have PKI set up properly and can do this. Other individuals who are particularly privacy conscious may also have this. Just because verifiable E2EE might not be applicable to a mass market doesn't mean it's not incredibly useful for those who do need it.