To my knowledge, under Signal, the encription keys are locally generated and stored, and the traffic flows between end points as a closed packet.

This does not seem to be the case here, as the keys are generated and stored outside your equipment and, thus, are viable to be used by a third party to access packets.

But I admit I speak heavily burdened by technical ignorance.