Stop calling Signal "the secure messaging app". It runs on AWS. It's centralized. Amazon can peek in to whatever crypto they're doing inside the VM. There are already reports of nation state actors gaining device access. Just because some crypto is solid doesn't mean the whole thing is solid. Like anything, it is only as good as its weakest link, or as Bruce famously said, a lot of information security works by putting a post in the ground and hoping the bad guys run in to it. Hell, call it "Signal the insecure messaging app".