Good point, probably blockstream. If the attacker has a clue they'd send that 1 message and maybe sandbag a signature not previously revealed for later proof.

They could have just emailed blockstream to set up a Signal chat.