I believe the citation falls under "street smarts" as the WikiLeaks press release mentioned Signal explicitly. Whether this was a subtle outing the origin of the tool itself is left as an exercise for the reader.

Regardless, the threat vector is accessing the data before encryption anyway. And drawing attention to yourself by running certain apps and services in the first place.

There's a lot of mathematicians in maryland and those who studied the history often land on "if they want you, they got you."

You have to think from time to time.

If there are even NDAs that forbid mentioning their existence - how would you cite them?

And here we're talking about 3-letter agencies in U.S.

Of course they have the access and of course you can't ever prove it. One could even argue that Julian Assange didn't leak anything and it's all lies and he can't prove it, lol.