Every Signal conversation has a safety number derived from the participants’ identity keys. Two people can compare it in person or through another channel. Matching numbers provide strong evidence that the encrypted conversation terminates at the expected devices rather than a substituted key.
Most people never compare one.
This is often treated as a usability failure. It is also a useful separation of assurance levels.
Ordinary conversations receive end-to-end encryption and warnings when keys change. A journalist meeting a source, an administrator handling recovery codes or a family discussing an immediate threat can perform the stronger, pairwise check. The protocol does not require a global authority to label every person “verified” in advance.
Verification belongs to a relationship
The safety number is not a blue tick attached to a universal profile. Alice verifies her channel with Bob. Carol’s verification of Bob is a separate event.
That prevents trust from silently becoming transferable. Carol may introduce Bob, but Alice can still decide whether the relationship needs direct verification.
The remaining design challenge is key change. People replace phones and reinstall applications. A warning that fires frequently for harmless maintenance becomes background noise. A warning that is too quiet fails exactly when substitution matters.
The strongest interface therefore does not merely display cryptographic truth. It helps a person understand why the key changed and what action fits the stakes.
Signal’s safety numbers are a good model precisely because they are optional, local and specific. Strong verification is available without turning every conversation into an identity checkpoint.