> you don't need to rely completely on trust in third parties because both produce reproducible open source clients (at least on android, not sure about apple)

> you don't need to rely completely on trust in third parties because both produce reproducible open source clients (at least on android, not sure about apple) and if someone hands you at least a client that you can verify doesn't send out non-encrypted data you have some legitimate safety compared to a service that doesn't do that at all. This is technically correct but not in a way that matters. Signal pushes everyone to depend on Google to distribute the software. Through this system, it isn't even just Signal, but also Google and anyone who breaks into Google that can inject a compromised client. You don't know that the client on the other side isn't getting its Signal app through Google. More importantly -- even if you DO know the client on the other side -- the WHOLE POINT of Signal is this massive network effect where you don't need to coordinate with the other side. If we're talking about the much smaller network-within-a-network of users who installed Signal from a non-Google source -- it's no longer compelling. Why bother with it? Less error-prone to get both sides to set something else up.