In this case, assuming you are using Signal on iOS, the app could very well decide to send all the decyphered messages of targeted users (users that say a certain thing, or users with a certain name) to a 3rd party server.
If they wanted to be undetected in all cases, they could leak data via the timing of the network packets.
And they could do all that without even knowing it, just by using a compromised toolchain.
Long story short, unless the SW (the app, the OS, the toolchains) and the HW have been audited, you have no idea what's going on.
Comments
In this case, assuming you are using Signal on iOS, the app could very well decide to send all the decyphered messages of targeted users (users that say a certain thing, or users with a certain name) to a 3rd party server. If they wanted to be undetected in all cases, they could leak data via the timing of the network packets.
And they could do all that without even knowing it, just by using a compromised toolchain.
Long story short, unless the SW (the app, the OS, the toolchains) and the HW have been audited, you have no idea what's going on.