The xdot dev libraries have support for multicast sessions. 3 addresses and keys can be registered for downlink.
Event handlers can be set to receive packets for normal and multicast packet with DevAddr.
A method to exchange keys can happen at the application layer.
A protocol for exchanging keys is being developed.