This seems like a relatively easy issue to fix. If they included a "password" to the proxy (and stuck it on the share URL) then the proxy can reject requests unless the password authentication passed. This way it would look like any other HTTPS site that was password protected. Only if you know the password would you get proof that the other end was connected to Signal.