[upofadown]

There is nothing wrong with allowing a consumer to verify that they are talking to who they think they are talking to. Is Signal a consumer product?

Zoom specifically states that they do not have access to session keys. Apple doesn't even make such a statement.

[xtian]

What prevents Signal from MITMing their app?

[upofadown]

The way everyone else does it. The user can verify the key fingerprint. Signal calls it the safety number.

[xtian]

Why couldn’t they just change the client code to exfiltrate the user’s data?