For signal the phone number serves as a convenience to label a public key - the security comes from verifying the key. The design is to not trust the server. W

For signal the phone number serves as a convenience to label a public key - the security comes from verifying the key. The design is to not trust the server. WhatsApp is the same but has things like key-change messages off by default. I believe telegram doesn't even encrypt by default, and has flawed crypto anyway. You're right that the whole thing is flawed to some degree unless both parties are clued up.