The current version has no publicly known issues, but suspicion is the only valid response when an entity rolls their own cryptography for production when such well-studied and secure options already exist.

> suspicion is the only valid response when an entity rolls their own cryptography for production

Strong disagree. I would rather have multiple solutions in production, and Telegram's is also well-studied.

Most established approaches were well studied before they were put in production, while Telegram has had the luxury of beta testing their protocol in real time on their 500 million users, and the work isn't yet done with issues discovered as recently as this year:

> But ultimately they prove that the four key issues “could be done better, more securely and in a more trustworthy manner with a standard approach to cryptography,” said ETH Zurich Professor Kenny Paterson, who was part of the team that uncovered the flaw.

https://www.cyberscoop.com/telegram-app-security-encryption/

I'd suggest you actually read the paper[1] you're referring to, because it's actually a lot less critical of Telegram's approach than you make it out to be.

We are better off that Telegram exists as an alternative. We don't need Signal's protocol (also used in Whatsapp etc) to be a potential SPOF.

To quote: The central result of this work is a proof that the use of symmetric encryption in Telegram’s MTProto 2.0 can achieve the security of a robust bidirectional channel if small modifications are made.

1. https://mtpsym.github.io/paper.pdf

I have read this paper. Not sure where you feel I mischaracterized it. The section you just quoted goes on to discuss caveats, including a recommendation that they swap out their low level cryptographic implementation with one that uses a standard and well-vetted library, and then criticizes them for not having e2e on by default.