That isn't quite how it is implemented, there are no HSMs, we use SGX for that function instead. See my reply to Josh's follow up for details. You need a rando

That isn't quite how it is implemented, there are no HSMs, we use SGX for that function instead. See my reply to Josh's follow up for details. You need a random id not the phone number, so other users can't do guesses unless they get that random id somehow. The ID is stored on the phone, and if you lose it, when you reinstall Signal, the signal server will give it to you after SMS phone # verification. A sim-jacker could nuke your key, but that seems like a lot of work for griefing. Signal of course, has the plaintext random id, so they could nuke your backup, but there are tons of ways Signal can DoS attack their own service. Stopping paying for the servers, for one.