If your system is compromised to such an extend, it really doesn’t make much difference how the keys are stored at rest.
If the keys are accessible to any process, your system doesn’t need to be compromised. All it takes is an App that you”trust” to break that trust and snatch everything up. Meta has already been caught fucking around with other social media apps on device. They even intercepted Snapchat traffic on some users devices in order to collect that data. It could be as simple as you installed WhatsApp and they went and pillaged your Signal files.
All it takes is an App that you”trust” to break that trust
I get what you’re trying to say, but that’s something I’d classify as “compromised” as well.