The scariest part of this recent news is that TM Signal seem(ed) to be interoperable. People using TM Signal could interact with actual Signal users. How are you to know whether or not your groups have people using bastardized versions of Signal? Are things like Session interoperable with Signal?
What is your worry about non authentic clients?
Poor security implementations that would become the weakest link in the security chain