You might want to read up on how Matrix works and what the spec says.

(I won’t comment on Session, I’m not familiar with the finer details there.)

I don't use it these days but please enlighten me or show me the specific section you are talking about. Specifically, I was referring to libolm.

This is a starting point: https://nebuchadnezzar-megolm.github.io/

Looks like they were addressed: https://matrix.org/blog/category/security

Glad it had nothing to do with libolm itself but how it is used/not-used. I thought they had 3rd party audits for this.

I run Signal just fine without Google Play Services. I am using e/OS which doesn't have it bundled.

I disabled it, it complained a lot and images/media wouldn't load.

Install the alternative APK that doesn’t use Play Services. https://signal.org/android/apk/

I believe I installed that but what I need is probably microg like the sibling comment suggests.

e/OS comes with MicroG as replacement.