Earlier quoted context omitted.
PGP is a protocol, there is nothing wrong with it. If you want to complain about good PGP based apps that is a entirely different argument (and it think that is what you are arguing). Signal is not a protocol, it is a application. It uses open whisper (or some mutation of it) as its underlying protocol. That being said, you are still relying on trust provided by the signal servers that they properly authenticated you…
Both of those statements are false. There are clear things wrong with the PGP protocol. PGP predates authenticated encryption (let alone modern AEAD ciphers) and the hacks PGP came up with to authenticate ciphertext resulted both in stripping attacks and, indirectly, in the Efail attack from last year. It was also Signal's linear packet based key format that resulted in the GnuPG/SKS attacks. Signal is a protocol; in…
In practice, the only allowed implementation does.
It finds your contacts based on phone number, it allows them to use any keypair, and it allows that key to change at any time. It shows a light grey item in the chat when the key changes, just "your safety numbers have changed" and then you continue chatting like nothing happened.
Even if you were paranoid about checking for the light-grey changed safety number message, there's practically no way to avoid it. There's no built-in way to back-up your keypair and then load it onto another phone, so you can't avoid needing to have your friends accept new keys whenever you get a new phone, or factory-reset your phone.
Maybe you want to fork the open-source client and fix some of these glaring security deficiencies ... nope, they don't want your fork connecting to their central servers. Federation is for silly nerds, no thanks.
Further - recent GPG's crypto implementations are not currently compromised, it's disingenuous to conflate the issues with mail client plugins and keyservers and the old constructions used 15 years ago with recent RSA keypairs.
GPG signatures are used to verify authenticity of debian, ubuntu, and arch linux packages, and these systems do not use keyservers. I've used gpg for a scripted system just for coworkers at my office. (We exchange keys and validate fingerprints in person in the office.) It works. It is not vulnerable to any currently known attacks.
You can't do any of that with Signal! Maybe signal's algorithms are the bees knees and will last for decades but it's just not a useful tool. It allows peer keys to change at any time, and encourages or even requires it!
If anything, I'd expect you to be promoting Keybase, it is "modern" and also does a lot to solve the key distribution and continuity problem ("for real users" you might say), that Signal does not do.
It's very frustrating to see you appeal so much to authority and say "my cryptographer friends and I all just laugh at silly geeks who don't trust Apple and Facebook and OpenWhisperSystems" and really not offer anything that could replace GPG as a tool for us "silly geeks" to use for practical purposes. We could chat with each other and feel good that Moxie's modern crypto is being used and not care when keys change, but that doesn't accomplish anything technically useful for us.