they did not disclose how have they done it for signal, and than mentioning linked devices. it could be that they got access to a linked computer of the user, and copied messages that way. there is not much signal could do against this. afaik the app already uses the system keystore to store api keys, and to partially encrypt its data, but the system keystore is often not so strong because its automatically unlocked