Not exactly a security flaw, as the new owner of the phone number won't have the original owner's secret keys (they never leave the phone, of course) and Signal

Not exactly a security flaw, as the new owner of the phone number won't have the original owner's secret keys (they never leave the phone, of course) and Signal will still send the messages to the previously authenticated client. Taking over a Signal account requires access to the phone number and the password used to register it (or waiting a week). And this will still not give the attacker access to the private keys; When these keys change, Signal will put an alert message on ongoing chats and ask for confirmation.