So even Latacora-advised startups use plain old email for bug bounties. Why then does the blog post recommend using Signal for that?
We also got super clever reports on that same bounty program. They just sent email.
Hmm I don't see it as theater if you are unable to intercept and decrypt my message. Or forge my signature, etc.