Ignoring the rest of the stack for a minute, any crime group should be hesitant to us software connected to the US. National security letters are still very mu

Ignoring the rest of the stack for a minute, any crime group should be hesitant to us software connected to the US. National security letters are still very much a thing there. Signal has fought at least one and won (https://signal.org/bigbrother/ https://signal.org/bigbrother/) we can only know about ones they've won against. Plus say you use Signal, how are you connecting? If that's through an app store then your binary has been replaced. A similar thing happened with Hushmail and their 'client side pgp' jar file: https://archive.is/IRYoh https://archive.is/IRYoh. Then you have to consider the sealed-sender stuff, and other metadata. If your crime group isn't specializing in tech crime in general then outsourcing to a third-party (that could use the Signal code internally) probably makes more sense then trying to figure this stuff out yourself.