I think they have reproducible builds on Android. iOS doesn’t allow that though.

There’s also a fork named Molly on Android. It’s nice.

My “easy” solution for b) :

1. Buy XMR from wherever you want (even KYC exchanges if you want and can)
2. (if you’re already on a CEX and don’t want to bother, withdraw USDT/USDC/LTC/BCH… any crypto with not insane withdrawal fees and which is fairly popular, and then exchange it on a non-KYC exchange for XMR)
3. Exchange your XMR at a non-KYC (or non systematical) exchange for your desired traceable cryptocurrency.

I can recommend https://trocador.app/ - nice exchange aggregator that doesn’t require you to log into the exchange’s website, and that displays the level of privacy of each exchange.

By using this method, you always have non-ML non-KYC crypto that can be used to buy anything

For additional (and true) privacy, please churn the XMR while you have it. If you know, you know, but that’s a power user move.

? Even if the servers are backdoored, your messages are still encrypted by your key - as long as the server didn’t manipulate the keys at the first exchange, which you can check by verifying the security code

If it matches, then it’s okay. Such features exist in all encrypted messenger apps

You can easily verify the keys of the person you’re speaking with, and they’re generated locally… so technically speaking, even if their servers are leaking, your messages are still unreadable, but yea that’s not ideal