The bigger problems for me would be the appstores because they could implement a mitm. Telegram and Signal have their client sources open so you at least can check and compile them yourself but if I would handle data that was so sensitive that I can't trust any other entity I would just self host matrix or xmpp and chat with myself...