All machines that wish to send files amongst themselves must have the same 'group code'.
Server generates its own self-signed cert and private key. The cert is encrypted with a sha256 hash of the group code and is embedded in the zeroconf service info.
Client discovers server, extracts cert and must be able to decrypt (with the same code) before connecting is possible.
If codes match, the cert can be retrieved by the client and connection proceeds.