How does "sealed sender" actually guarantee that without some type of bizarre onion-style routing?
At the end of the day they literally control the only in-pipe and the only out-pipe and can measure whatever the heck they want from it. Including from which address the message came from.
Any activity that leaks identity to the server, such as phone number validation, asking it for X profile, asking it for whatever key is needed to encrypt messages for X, etc.
Those happen infrequently enough that you can switch addresses in the mean time, and if you use a NAT it becomes harder. AFAIK they didn't claim it's a perfect solution, but it does help, and means that Signal doesn't have the same metadata as WhatsApp does.
At the end of the day they literally control the only in-pipe and the only out-pipe and can measure whatever the heck they want from it. Including from which address the message came from.