Actually there's a way to check the code running on their servers. At least Signal claimed that: Modern Intel chips support a feature called Software Guard Ext

Actually there's a way to check the code running on their servers. At least Signal claimed that: Modern Intel chips support a feature called Software Guard Extensions (SGX). SGX allows applications to provision a “secure enclave” that is isolated from the host operating system and kernel, similar to technologies like ARM’s TrustZone. SGX enclaves also support a feature called remote attestation. Remote attestation provides a cryptographic guarantee of the code that is running in a remote enclave over a network. https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/ But of course you need published source code and reproducible build.