Regarding verifying the application running server side matches the expected OSS version, Signal has an innovative approach as a part of their zero-knowledge co

Regarding verifying the application running server side matches the expected OSS version, Signal has an innovative approach as a part of their zero-knowledge contact discovery system. > Run a contact discovery service in a secure SGX enclave. > Clients that wish to perform contact discovery negotiate a secure connection over the network all the way through the remote OS to the enclave. > Clients perform remote attestation to ensure that the code which is running in the enclave is the same as the expected published open source code. > Clients transmit the encrypted identifiers from their address book to the enclave. > The enclave looks up a client’s contacts in the set of all registered users and encrypts the results back to the client. >Since the enclave attests to the software that’s running remotely, and since the remote server and OS have no visibility into the enclave, the service learns nothing about the contents of the client request. It’s almost as if the client is executing the query locally on the client device. It's not perfect, but it is a huge improvement over blindly trusting the software running on a third party server. There's a lot more detail, including pitfalls, work arounds, limitations, and of course source code, in their blog post on the subject : https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/