This sounds good on first pass, but consider the implication of allowing donations (and thus, payment method information) to be tied to a Signal users account. I specifically _wouldn't_ want this.
All you need to store server-side is "this user has the badge until date X".
Sure, but espionage and surveillance are rarely about proving anything, they're about making good educated guesses. Besides, the receiver will very likely be among your friends and acquaintances, so the NSA would only have to look at your social circle to find them.
display_badge_until
Store no payment info.