> By disabling signature verification you open yourself up to man-in-the-middle attacks and supply chain attacks.

I am no expert, but AFAIK Android does not disable signature verification when installing from "unknown" sources. It verifies the APK is signed and unmodified on every install, and enforces key continuity on updates.

Signal uses the same signing key for both the Play Store and signal.org APK, so if you at any point installed from the Play Store, the key identity is (as far as I understood) attested by Google, and every subsequent update from either source is verified against it.

I do think that Obtainium pins the key as well, so even without Play Store: If the original install through Obtainium wasn't a manipulated version, you should enjoy the same continuity.

I get the idea about a hypothetical threat actor from within Signal poisoning my specific install. But I think I'll roll with it for now.