Yet WA defaults to not notifying contacts when keys change. So silent interception is more likely to go unnoticed. And any app could send an automatic update with a backdoor at any moment.

Disassembly and analysis is also harder with binaries than original sources and an open, reproducible build process.