How does reproducible builds help you verify that you friends don’t have compromised builds installed? I haven’t used Signal, so I don’t know, but is there some way for your client to verify the client on the other end?
Knowing that your client isn’t compromised is pointless if you friend can’t/won’t do verification on their end.
Knowing that your client isn’t compromised is pointless if you friend can’t/won’t do verification on their end.