I actually believe the Russian government can do that. It's trivial for a messenger app to include code that sends a copy of your private key to the messenger

I actually believe the Russian government can do that. It's trivial for a messenger app to include code that sends a copy of your private key to the messenger app's company's HQ, if served with a warrant or if obliged by law (and that seems to be precisely what's happening here). If the messenger app is open-source (like Telegram or Signal), you can satisfy yourself that the messenger app isn't sending your private key behind your back. But it's a different story if the app is closed-source and its parent company was involved in PRISM (like Whatsapp).