Some additional things I'll tack on:

Personally, I don't love having multiple devices attached to a Signal account. Especially desktop computers.

Multiple devices means multiple opportunities for someone to gain access, and having some of those devices be PCs opens you up to whole other classes of malware that could potentially nab your messages.

Runa Sandvik pointed out how it seems like biometric access on a work computer may have given the FBI access to a WaPo journalist's Signal messages. https://x.com/runasand/status/2017659019251343763?s=20

Multiple clients is great for convenience, but some friction can be a good thing.

As a counter example, it seems like investigators may have been stymied by an iPhone's lockdown mode.

https://www.404media.co/fbi-couldnt-get-into-wapo-reporters-iphone-because-it-had-lockdown-mode-enabled/

I want to stress that this is a very incomplete picture; there could be tools and strategies in use that we can't see. But based on what we know, limiting devices and how those devices can be accessed seems like a good strategy.

I mention in the article that malware could potentially access Signal messages. This is an area where I don't know a lot of specifics, but one thing did pop up recently that I thought was interesting.

NYT and 404Media have reported on new tools purchased by DHS. From NYT:

"One of the tools, which was built by Paragon, an Israeli technology company, lets people take control of phones or remotely hack into them to read messages or track locations."

https://www.nytimes.com/2026/01/30/technology/tech-ice-facial-recognition-palantir.html

Would this include Signal messages? Is this actually in use and working as described? I don't know, but it demonstrates that there are more exotic threats to mobile device privacy.