I've decided to stop using Signal for my private conversations. This decision comes from a broader reflection, also informed by the discussion on the forum, where it becomes apparent that over the past few years Signal seems to have gradually softened both its ideological and practical distance from ecosystems like Google.
Even if the exact details are not always transparent, it is clear that something has changed within the structure and governance of the foundation, and that this shift has significantly influenced the direction of the project. These changes raise legitimate concerns that, imho, cannot be adequately addressed by simply repeating that everything is end-to-end encrypted.
Saying "communication is encrypted" is not sufficient to meet the standards of a true zero-trust model. There are still unresolved questions regarding metadata exposure, infrastructural dependencies, and the overall transparency of the system, and these issues cannot be dismissed with overly simplistic assurances.
A recent example that reinforces these concerns is the introduction of encrypted cloud backups. While they are designed to preserve privacy through strong cryptography, they also introduce persistent user data on Signal's infrastructure and increase the overall system complexity. This does not necessarily mean that Signal can access user data, but it does imply a shift away from the original principle of minimizing server-side state.
For the time being, and until I am able to fully migrate away, I will rely on Molly as an alternative. It is a solid option and aligns better with certain security and control requirements, although it is not, by itself, a complete solution to all the concerns outlined above.
... On Chat Control ...
Signal's public opposition to Chat Control is certainly preferable to silent compliance, but its communication increasingly feels like an attempt to recover credibility through public positioning rather than through structural change.
Threatening to leave the European market if privacy protections are weakened may sound radical, but it still operates within the logic of a centralized platform: a single organization retains control over the service and asks users to trust its willingness to resist external pressure. The message is essentially: "if regulation becomes unacceptable, we will withdraw the product".
This is very different from designing a system in which no single organization has the technical power to impose surveillance on the entire network in the first place.
Projects such as Tor and SimpleX take a more convincing approach. They do not merely argue that privacy should be protected; they modify the technical architecture so that control, identification and surveillance become structurally harder. Tor's principle that "privacy is a human right" is not only a slogan, but something reflected in its decentralized infrastructure, threat model and resistance to centralized control.
SimpleX follows a similar logic by removing global user identifiers and allowing independent servers and clients. Its privacy does not depend entirely on the courage or goodwill of one foundation.
Signal, by contrast, often appears like a dog barking aggressively from behind a gate: loud in its opposition, but still unwilling to dismantle the gate itself. It denounces surveillance while preserving an architecture based on centralized infrastructure, official clients and a single governing organization.
The real issue is therefore not whether Signal currently intends to protect its users. The issue is that users must continue trusting Signal to make that choice for them.
That is difficult to reconcile with the strongest interpretation of privacy by design.