Perfect forward secrecy. Signal's 3DH key exchange does it. The authentication output is only meaningful to the original conversation participants, because the

Perfect forward secrecy. Signal's 3DH key exchange does it. The authentication output is only meaningful to the original conversation participants, because the only discernable difference between a real and a fake authentication even with access to all user keys and ciphertext is provenance - you know this output originated from a direct response to your cryptographic challenge, but nobody else can be sure you didn't just compose it yourself. (Only the key-holders in a conversation between the "authenticatee" and challenger can generate valid looking answers for their specific pair of keys - either mutually between each other, or all by themselves in order to achieve repudiation)