<?xml version="1.0" encoding="utf-8"?>
<!--
  Release / main: HTTPS only, system CAs. Self-hosted signal servers must use
  publicly trusted certificates (e.g. Let's Encrypt) or users cannot connect.
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
</network-security-config>
