Surprisingly Telegram awfully good on that list
Edit: I forgot to add that I found something little of about that report where Signal hash to phone numbers are absent " Which clearly signal store it"! And on Threema FBI still includ it even though it’s optional and 99℅ of the user will not put their number.
The Telegram app is open-source and the encryption algorithm as well. The problem is that it uses an totally non-standard in-house developed encryption algorithm that security researchers are suspicious off (but no actual vulnerabilities are known right now).
They are finding problems like “crime-pizza”:
https://ethz.ch/en/news-and-events/eth-news/news/2021/07/four-cryptographic-vulnerabilities-in-telegram.html