> It sometimes feels like the security community is a bucket of crabs where any time something starts getting traction due to ease of use a lot of others try to pick at it due to it not being perfect even if many of those things are trade offs
That's because when it comes to security often theoretical vulnerabilities end up being protocol-destroying vulnerabilities in practice. Security folks are notorious for saying, 'that won't work,' being ignored — and then everyone being surprised when indeed it doesn't work.
> phone numbers allow for signal to be a drop in replacement for other messaging apps with minimal to no registration required
The issue is not allowing phone numbers as identifiers: the issue is in not allowing other identifiers. There's already a URN scheme for telephone numbers, and there are URN schemes for many other identifiers, to include email addresses, and there are even ways to add additional schemes. If Signal used URNs rather than telephone numbers, then users could continue to use telephone numbers but advanced users could use other identifiers, as they wish.
> lack of federation means ows can control spam better unlike in a federated environment where lazy/malicious operators can cause lots of problems
A spammer cannot spam someone whose public key he does not know. If there is no central directory of identifiers to public keys, there's no way for a spammer to send spam. It is possible for someone who knows one's public key to spam one, but since the sender's public key is tied to a public identifier, one knows who sent the spam.
Does Signal perform any anti-spam activity anyway?