[objectiveariel]

I actually believe the Russian government can do that.

It's trivial for a messenger app to include code that sends a copy of your private key to the messenger app's company's HQ, if served with a warrant or if obliged by law (and that seems to be precisely what's happening here).

If the messenger app is open-source (like Telegram or Signal), you can satisfy yourself that the messenger app isn't sending your private key behind your back.

But it's a different story if the app is closed-source and its parent company was involved in PRISM (like Whatsapp).

[mattvot]

> If the messenger app is open-source ... you can satisfy yourself that the messenger app isn't sending your private key

But only if you are building and installing the app from source, and have audited each release. OS apps installed through app stores suffer the same lack of visibility as a CS app.