Even the most rigorous proof cannot fully capture messy real-world systems. Signal runs across diverse devices, codebases, and updates, where unmodeled edge cases can emerge. Heartbleed was a single rogue variable in an implementation nobody had formally modeled, rather than an inherent design flaw. Projects like Signal Shot may strengthen assurance, but cases like Heartbleed suggest full, end-to-end proof of real-world security remains an elusive, andif perhapsnot even unattainableimpossible, goal.