The answer should be use signal that has been configured in a hardened way. Everything else can't be trusted. Hell even with signal if it's really sensitive Encode with pgp using their public key then send through signal then they decode using their private key.