I’ve been told by many many candidates that all work they ever did was under an NDA and so they have no Github profile and not even any code samples. Somehow they never did a single shareable thing in their lives - not at school, not a hobby project, not at work.
Potential employers use all the signals available to make decisions and this is an important one. Many of the other applicants will have solid material. It may not at all be your fault, and yet also be a serious disadvantage.
If the people from Signal start a conversation with you on the number you emailed, how do you know it’s actually them? Couldn’t it be a third party who intercepted your email?
You need to check their “safety number”, and now we’re back to the same idea as with PGP with web of trust and key sharing parties.
At some point you still need some kind of pub-key identity check if you don’t want to accidentally report your vulnerability to PRC instead.
Potential employers use all the signals available to make decisions and this is an important one. Many of the other applicants will have solid material. It may not at all be your fault, and yet also be a serious disadvantage.