the recommended fix here is to add a PIN + enable registration lock

IIRC signal PIN was very controversial back in the day because they were 1) forcing users to do it and 2) forcing them to opt in to some data collection as part of creating a PIN. Signal backed down on requiring a PIN, but now it's unclear from their settings page whether setting a PIN will share data as well. The marketing copy on my droid device says:

> PINs keep information stored with signal encrypted so only you can access it. your profile, settings and contacts will restore when you reinstall

For a company with relatively good cred, this is a shady way of saying 'we will upload your contacts and encrypt it with a short string'