What is the basis of the assertion that "Signal isn't affected"? Do you track CVEs for Signal?