Thanks for that link. I'll go through the build process and play with the apk.

But even if I wanted to build my own apk, and run it on my custom Android build, it would'nt work right? Because of the need for Google Play store?

Verifiable builds are atleast a step in the right direction.

Why do you need the play store? You can install apk files without it just fine, if you have the appropriate dev options enabled in your phone.

Signal requires the Google Play Services to work, and includes several proprietary libraries from Google in their app, too.

And so? You're still trusting them and the various libs they're using to protect you... Did you read the code? Did you understand it?

Me neither. How can a bit of software like this obtain any kind of reputation whereas we barely trust openssl anymore is fucking beyond my understanding.........

This criticism applies equally to every piece of software you haven't written yourself. You have to trust someone at some point. OWS has demonstrated that they are more trustworthy than their competitors.

Sure, but the ease of someone abusing this is far greater than what we've been using before.

Can you honestly say that you trust signal over locally or even airgapped pgp'd text?

Nope! But they solve two completely different problems. And the metadata with Signal is actually much better than PGP+email. Have you looked at email headers recently?