Any client-side limitations are not part of the security model because you don't control other people's devices. Even with an unmodified app, they're trivially bypassed using a rooted/jailbroken device.
Not part of Signal's security model, but trusting people in that chat very much can and should be part of the user's security model. If you don't trust them, why are they in the chat in the first place?
It's not a person in the chat, it's an account. The account is usually controlled by the person associated with it, but you can't assume that it's always controlled by that person.
Is it though? I think TM Signal is just emailing the chats to a server from the phone it's installed on.
> If you don't trust them, why are they in the chat in the first place?
Journalist? Taliban negotiator? Ex-wife?
You are conflating "trust in all ways" with "trust to receive the communications in the specific chat they are party to". The former is not relevant.
Well the ex-wife in question can be trusted to receive it a-okay and screenshot them to send to her lawyer and cops too, depending on contents. So do US government officials. Now we just know how exactly they do it.
Or with the more affordable (in terms of skills) method of using another phone to take pictures of key messages on the screen of the first one.