I was thinking something like using the SMS channel which, IIUC, was originally for carrying solely control information and ergo is a side-channel; more in the telecoms sense than the crypto sense. Yes, perhaps "covert channel" would be better.

Do you have any response to the substantive point or just quibbles on the semantics.

The bigger point he's making is that your comment "Anyone who can read a control flow graph" can be taken to mean everything is fine here when it's really not.

Its not hard to imagine how WA could be compromised without anyone knowing for many years.

I don't understand what you are trying to say here, sorry.