You think it matters where the key lives? Why do you think that?

Do you think it irrelevant that your phone auto-updates without consent (citation in TFA), do you think it irrelevant that the reproducible builds are -- not, you wouldn't ever need to touch the key to bypass signal. You want me to go into semantics but anyone with half a technical brain knows that RCE, logging, remote screen capture, or anything that can read memory will easily break security and doesn't have to be colocated with the code that actually does the encryption/decryption.

Also I made multiple technical claims:

* "third party clients are a no go"

* "third party networks are a no go"

* "Automatic updates are enabled and forced" (due to "move fast" ;))

* "The code on the server has been provably non-public"

* "Forces the use of a globally unique number that can often be tied to personal identity and will always be tied to physical location"

Care to answer these? ;)

EDIT: seems like Signal has a spotty relationship with reproducible builds but they are trying to keep it and even have an automated job for it, though it seems people are often unable to reproduce: https://community.signalusers.org/t/beta-feedback-for-the-up...