Signal replaces manual safety number checks with automatic key verification

Signal has shipped Automatic Key Verification: key changes go into an append-only log whose root is signed by three independent auditors — Signal, Cloudflare and Trail of Bits. Clients show the "Encryption verified" checkmark only when all three signatures are no more than seven days old.

• Manual safety number comparison is replaced by automatic key verification
• The key log is signed by three auditors: Signal, Cloudflare and Trail of Bits
• Signatures must be under seven days old, bounding split-view attacks
• Verification proves key consistency, not the real-world identity behind an account