Unfortunately, every device that has Signal installed, also has a root kit installed: the play store.

If I use PGP-encrypted mail, I have to trust that the receiver is not stupid. If I use Signal, I have to trust that Google is not evil. Hmm...