There's other stuff protecting you when it comes to Signal: FOSS code, professional audits, reproducible builds etc. If you can't trust networked TCB there's n

There's other stuff protecting you when it comes to Signal: FOSS code, professional audits, reproducible builds etc. If you can't trust networked TCB there's not much you can do anyway. Adding one or more networked TCBs that also need to be compromised isn't going to turn into anything magical. It's about the architecture, and if you need architecture of "no sensitive key/pt material on networked device(s)", you're out of options quite fast. It's either airgaps (shown to be weak as I linked the IEEE etc. articles above), or split TCBs (AFAIK my research on that is the only public work available).