That said, WhatsApp using the E2E Signal protocol is immaterial if they exfilter the locally stored private keys out to their servers, which is what the redaction of that line in the whitepaper we both linked (you directly, me via that Twitter link highlighting the diff) alludes to:

> At no time does the WhatsApp server has access to any of the client's private key.

Unless one checks every update of the client's code and the matching published reproducible binary output one can't be sure that keys (or any other data for that matter, since it has full access to anything decrypted) are not exfiltrated.

Now, that line deletion could be a subtle canary because law enforcement/state actor, or that could be Meta being nefarious following the cofounders departure, or anything in between. Either way I find it a worrisome signal that this specific line has been removed.

They don't do that.

Biggest issue with WA is the backup mechanism. You can encrypt it with a passphrase nowadays but AFAIK that's off by default, rendering E2E moot if either party backs it up to their Google Drive.