At some level you always have to trust whomever is vending the software you use. If you don't audit and re-audit every bit of code in the whole stack for only

At some level you always have to trust whomever is vending the software you use. If you don't audit and re-audit every bit of code in the whole stack for only alternative, as flawed as it is, is doing calculus based upon the reputation and character of the people producing the code. We differ in that I stopped using keybase when the stellar airdrop occurred. That company is now an appendage of Zoom, another company I've watched closely from a security point of view. I imagine you are also a happy user of that, whereas I'm a begruding/throw-away-laptop-under-duress user. I haven't seen the code from either product but have made a judgement based upon their behaviour. This is the topic of this debate. If you find it exhausting reading comments from people trying to explain why they might be losing trust in a piece of trusted software, you are free to not read the comments and spend more time auditing code. ps. There are literally thousands of encrypted messaging apps. That Signal claims to be another is a small differentiator. How does it back up the claim? These lines of reasoning always lead back to the people running the show and how they behave. Short of a State actor using gagging orders to insert back-doors, which is way outside at least my thread model, I moved to Signal because of its claims plus its aggregate reputation.