It was a long time ago. If you're a signal user and you're only hearing about this now, that should tell you all you need to know about how trustworthy the service is.

There were a lot of users upset about it at the time (myself included), but their protests went largely ignored. Tellingly, they've refused to update their privacy policy to reflect their new data collection practices. Personally, I take that as a huge dead canary.

https://community.signalusers.org/t/proper-secure-value-secu...

https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac...

https://community.signalusers.org/t/dont-want-pin-dont-want-...