Perhaps your man the incognito keyboard option? Signal uses it, but no API I can imagine will protect against a malicious IME. Worse still, even if you block I

Perhaps your man the incognito keyboard option? Signal uses it, but no API I can imagine will protect against a malicious IME. Worse still, even if you block IME internet access on a device with a factory-maliciois IME, they could just upload the data using some other service on the device. Installing a known-good IME seems like the only fix I can think of?