Encrypted messages include a "transcript hash" of their parent and all prior messages as "additional authenticated data".
The hash also covers the sender_key for each message DATA messages (set to zeros for cleartext all other messages):
H(parent) = SHA256(sender_key[parent] || msg[parent] || H(parent-1))
== Timing ==