The thing about endpoint-to-endpoint security is that it really sucks if one of your endpoints is compromised.

The "Signal" was not broken & the encryption worked, the part that didn't was when the encryption was removed and the user presented with plain text.