Signal Automates the Safety Number Check, and Adds Cloudflare and Trail of Bits to Its Trust Base

Signal has shipped Automatic Key Verification, part of a key transparency system that uses Cloudflare and Trail of Bits as trusted third-party independent auditors to check the integrity of Signal conversations ^[1][2]. It matters because the assurance it replicates, manual safety number comparison, has always carried a cost most users refuse to pay: an in-person meeting or a secondary communication channel ^[3].

The threat model is stated plainly by Signal software engineer Katherine Yen: the system ensures that the association between a phone number or username and its public encryption key is globally consistent and transparent across Signal's ecosystem, protecting against a key being swapped out without the owner's knowledge, including the case where a malicious party compromises Signal itself and binds a different key to your contact's phone number ^[4]. That is a server-compromise threat, and it is the one end-to-end encryption users are usually least equipped to detect on their own.

The mechanics are unglamorous, which is the point. Users enable it under Settings > Privacy > Advanced ^[5]. On the safety number verification screen there is now a "Verify Automatically" option; success produces a green checkmark and an "Encryption verified" message ^[6]. According to Yen, the assurance comes from verifications performed independently by the user, by their Signal connections, and by the third-party auditors, accumulating over time rather than resolving in a single handshake ^[3][7].

Note what is being traded. Signal says users who do not want to rely on Signal or the independent auditors can turn the feature off and stay with manual safety numbers ^[8], which is an honest admission that this shifts the verification burden from your own eyeballs to Signal plus two named organisations. Cloudflare and Trail of Bits are now inside the trust base for anyone who leaves the toggle on ^[2][8]. Signal frames key transparency as complementing the existing safety number system rather than replacing it ^[9]. Also worth reading carefully: the reporting describes the feature as something users switch on in settings ^[5], not as a default.

Context for why Signal is spending engineering time here. In May the company added warning messages and in-app confirmations to slow users down when they evaluate external requests, as a safeguard against phishing and social engineering ^[10]. That work was prompted by attacks attributed to Russian state-sponsored hackers who targeted high-profile users with bogus "Signal Support" alerts that abused the Linked Device feature to reach accounts, chats and contact lists, as reported by the FBI, German authorities and the Dutch government ^[11]. A month later, the U.S. State Department announced bounties of up to $10 million for information identifying or locating members of UNC5792 and UNC4221, groups tied to widespread phishing against Signal users ^[12][13].

Those two problems are not the same problem. Key transparency addresses key substitution ^[4]; the campaigns described above worked by convincing a target to link an attacker-controlled device ^[11]. A green checkmark on a verified key says nothing about who else is holding a session on the other end.

What to watch: whether Automatic Key Verification becomes the default rather than an advanced setting ^[5], whether Cloudflare and Trail of Bits publish audit output on a schedule an operator can actually check, and whether the "Encryption verified" badge ^[6] starts being read as a general safety signal rather than the narrow key-consistency claim it is.