If your claim is:

Privacy isn’t an optional mode — it’s just the way that Signal works. Every message, every call, every time.

Yes, there is in fact a duty to at least warn people that their very means of input is an attack vector. Yet the Signal App public-facing messaging says nothing of the sort. Instead it says:

State-of-the-art end-to-end encryption (powered by the open source Signal Protocol) keeps your conversations secure. We can’t read your messages or listen to your calls, and no one else can either. Privacy isn’t an optional mode — it’s just the way that Signal works. Every message, every call, every time.

You have to go pretty damned deep in the documentation before you finally get the tepid warning about keyboard apps. Like really deep. With no actual mitigation suggestions or recommendations. Almost as if, you know, they don’t actually give a damn.

If your target market is security professionals, this is barely forgivable since they would presumably know about attack vectors like this. This, however, is what Signal seems to view their target market as:

And I, for one, think there’s a responsibility when security pros market to normies. A responsibility which Signal App has been actively dodging (they’ve had their feet held to the fire for this from multiple sources!) for years now.

Almost as if, you know, they don’t actually give a damn.

Almost.