If Signal really puts messages onto their servers behind easy to brute force PINs with the only protection being the SGX pixie dust, and maintainers really don'

If Signal really puts messages onto their servers behind easy to brute force PINs with the only protection being the SGX pixie dust, and maintainers really don't see a problem with it, then the end to end promise of Signal becomes moot and I'd feel that they'd have betrayed their user's privacy. However, this is not what they are announcing. Signal does not store any message content in the cloud. It's only your address book as well as the list of blocked accounts. So that you don't completely start from scratch when you lose your phone. This makes total sense. If you assume that SGX is insecure and Signal can just brute force the PINs (definitely a legitimate view!), then address book equivalent data is already available to Signal in the form of who-talks-to-whom metadata. The only difference is that the metadata needs to be collected over a time span while address books only require short time compromises of the architecture. But this is a minor regression in security, for a large gain in usability.