It doesn&#x27;t protect users from that yet (neither does Signal or any other alternative), but we are about to implement reproducible builds to help mitigate that by allowing users to independently verify that the deployed production build matches up with our source code on GitHub.<p>That having been said, my cofounder and I are the only two people with the keys to sign releases (and as long Cyph exists they&#x27;ll only ever be held by either ourselves or an equally small set of individuals deemed worthy to trust with our lives) — so you shouldn&#x27;t ever expect that kind of deliberate backdoor, even if I end up in prison for refusing. We&#x27;re also maintaining a strong focus on OpSec of these keys, e.g. we&#x27;re about to migrate the release signing off of our (full disk encrypted) personal laptops to a dedicated air gapped environment.<p>As far as how the tech works, we don&#x27;t have a great explanation on the website yet, so this reddit comment will have to do for now: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;encryption&#x2F;comments&#x2F;4027ci&#x2F;how_2_spacex_alums_are_using_encryption_for_good&#x2F;cyywmc8" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;encryption&#x2F;comments&#x2F;4027ci&#x2F;how_2_sp...</a>. There&#x27;s also a visualisation in <a href="http:&#x2F;&#x2F;cyph.team&#x2F;producthandout" rel="nofollow">http:&#x2F;&#x2F;cyph.team&#x2F;producthandout</a>, if that&#x27;s helpful.