Signal Adds a Silent Witness: A New Feature Closes a Key-Swap Loophole- 326

August 14, 2026

Signal has rolled out Automatic Key Verification, a new feature designed to answer a question the app's existing security model always left to the user's own initiative: how do you actually know the encryption key protecting your conversation with someone hasn't quietly changed underneath you? The feature is built on a "key transparency" system that brings in Cloudflare and the security research firm Trail of Bits as independent third-party auditors, providing what Signal software engineer Katherine Yen describes as the same assurance manually verifying a safety number would give — without requiring the in-person meeting or secondary communication channel that manual verification has always demanded in practice, and that almost nobody outside the security community has ever actually bothered to do.

The underlying threat the feature addresses is a subtle one: a scenario where a key gets swapped out for a contact's phone number or username without that person's knowledge, for instance if Signal's own infrastructure were compromised and an attacker associated a different encryption key with a target's identity. Under Signal's existing model, detecting that kind of substitution required a user to manually compare safety numbers with their contact through some channel other than Signal itself — technically sound, but a step that requires real friction and real awareness of the threat to actually perform. Automatic Key Verification instead relies on a continuous system of cross-checks performed by the user, by their Signal connections, and by the third-party auditors together, ensuring that the link between a phone number or username and its public encryption key stays globally consistent and visible to every participant in Signal's ecosystem, rather than something only verifiable through an active, deliberate manual check. The feature lives in Settings, under Privacy and then Advanced, where users can toggle it on, and it can also be triggered directly from the safety-number verification screen by selecting "Verify Automatically" — a successful check returns a green checkmark and an "Encryption verified" confirmation. Users uncomfortable relying on Signal or its named auditors retain the option to disable the feature entirely and fall back on manual safety-number verification exactly as before.

This is not Signal's first defensive move this year, and the sequence matters for understanding why the company built key transparency specifically now rather than as a routine feature update. In May, Signal introduced new warning messages and in-app confirmations giving users additional time to evaluate the legitimacy of external requests before acting on them — a direct response to attacks attributed to Russian state-sponsored hackers, who had been targeting high-profile Signal users with fraudulent "Signal Support" alerts designed to abuse the app's Linked Device feature and gain access to a target's account, message history, and full contact list. The FBI, German authorities, and the Dutch government all reported on the same campaign independently, giving the threat multi-country confirmation rather than resting on a single source. A month after Signal's May safeguards shipped, the US State Department announced bounties of up to $10 million for information leading to the identification or location of members of UNC5792 and UNC4221, two hacker groups tied to widespread phishing campaigns specifically targeting Signal users.

Read against that backdrop, Automatic Key Verification looks less like a routine trust-and-safety improvement and more like the second half of a deliberate two-part response: the May update addressed the social-engineering entry point — the fake support alerts convincing users to link a new device themselves — while key transparency addresses the harder, quieter version of the same underlying problem, a key substitution that would leave no equivalent warning prompt for a user to notice or dismiss. For an app whose entire value proposition rests on end-to-end encryption actually meaning what it claims, closing the gap between "the message is encrypted" and "the message is encrypted to the person you think it is" is not a cosmetic addition — it is the specific assurance a state-sponsored campaign, however it evolves next, would need to defeat before it could compromise a conversation without anyone involved noticing that anything had changed at all.