So, the first question to ask here is:
How can a user be sure they are actually talking to who they think they are talking to? How can they be sure that they are not instead connected to a server somewhere that is simply forwarding the data between users while recording it? Who do you have to trust?
An example of the sort of thing I mean:
Signal Messenger verifies your phone number through the phone system for default identity verification. So you trust:
* The people that run the Signal servers
* Twilio (the ones that provide the SMS verification)
* The phone company
Signal also has the option to do direct verification by comparing key fingerprints (they call them Safety Numbers). Then you are truly end to end and only have to trust your correspondent (and yourself I suppose).