Messaging apps such as WA or Signal have no means of verifying keys, require phone numbers tied to the users’ real identity, operate based on a client-server model in which the server could be compromised by well-resourced agencies and require black-box phones that are not secure against phone manufacturers and agencies with whom they collaborate.

Users should be warned of perils of phones not quite under their control. Set up a proper FOSS machine that you understand, and use own encryption (be it PGP or some other tool serving the same purpose).