Signal outsources the coffee shop: two auditors now check the keys nobody was checking

Signal shipped automatic key verification on Tuesday, in a post by software engineer Katherine Yen, and the ledger behind it is signed independently by both Cloudflare and Trail of Bits ^[1][8]. That addresses the one attack that survives mathematically correct end-to-end encryption: the server hands you the wrong key, everything still works, and a third party reads the conversation ^[3].

The failure mode is dull, which is why it lasted. Signal states it plainly: a key can be swapped out without the owner knowing, for example if somebody compromised Signal itself ^[3]. The padlock stays shut. The industry's answer for a decade was safety numbers, the long string you were meant to compare with your contact in person or over a separate channel ^[4]. Almost nobody did ^[4]. A security control that requires a coffee shop is a security control most people skip ^[4].

What replaces it is a tamper-evident ledger. Signal keeps a log tree and prefix trees recording registrations and account changes, and independent auditors sign each entry ^[5]. Your app checks your own identifiers automatically and periodically; checking a contact is still a tap on the safety number screen, where the button now returns a green checkmark and the words "Encryption verified" ^[6]. Yen writes that the checks "provide the same assurance as manually verifying safety numbers" without an in-person meeting ^[7].

The auditor count is the load-bearing detail. Cloudflare's own release describes it as one of the external auditors and does not name the other; Signal names both firms, each signing the ledger independently ^[8]. Two is the minimum that makes the design work, because the entire point is that no single party can show one version of the log to one user and a different version to another ^[9][19]. A single-auditor version would reintroduce the trust problem it exists to remove.

Cloudflare's job is narrow by construction. It pulls batches of updates from Signal's log, checks cryptographically that each update is consistent with everything recorded before it, signs it, and Signal passes the signed version to users ^[10]. It works only over cryptographic proofs and does not see phone numbers, usernames, public keys or message contents ^[11]. The implementation is Rust on Cloudflare's Workers platform, using an append-only verification method from Meta's open-source key directory library ^[12], and it is the same infrastructure Cloudflare has run for WhatsApp since September 2024, with results published to a public dashboard ^[13].

Signal is candid about what this does not do, and operators should read the limits before filing it as solved. The system proves a key belongs to an identifier; it does not prove the identifier belongs to the person you think it does ^[14]. You need your contact's phone number, so username-only discovery is not covered ^[15]. If a contact changes their number the check stops working, and Signal's advice is to follow up through a secondary trusted channel, which is the coffee shop again ^[16]. The feature can also be turned off, with the toggle in Settings under Privacy and then Advanced, according to BleepingComputer ^[17].

Worth watching: whether the auditor set grows beyond two, since the security argument scales with independent signers ^[9]; whether username-only accounts get covered ^[15]; and whether Signal's ledger gets public results reporting of the kind Cloudflare already publishes for WhatsApp ^[13]. Cloudflare is positioning this as a standard rather than a product, with chief technology officer Dane Knecht arguing that the web moved to encrypted connections by default with HTTPS, messaging did the same with end-to-end encryption, and "independent auditing is the logical next step" ^[18].