This misses the Waltz_2 problem. Waltz's device is cracked (assume). So even if he's using real Signal the plaintext is exposed once it's decrypted by his device.