Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary.

Any system where the government doesn't have total control over software deployment will never be viable for handling claasified information.