You can download the APK from their site[1] and have been able to for several years, that's how I install it on my devices (and it does autoupdates). As for ha

You can download the APK from their site[1] and have been able to for several years, that's how I install it on my devices (and it does autoupdates). As for hash collisions, as far as we know SHA256 hasn't been broken yet and even if it were broken you would need to be able to create a valid APK with Signal's code and the backdoor which hashes to the same thing as Signal. [1]: https://signal.org/android/apk/ https://signal.org/android/apk/