@soatok Meanwhile, Signal having no fallback to plaintext. And I would genuinely be *extremely* surprised if it has a fallback that allows using 1024-bit RSA in a mode where invalid certificates and incorrect certificate hostnames are accepted…Almost makes me curious if there is any way whatsoever to trick a user into having not strict_tls there. Not curious enough to go digging through the code, though.