WG works for us, but isn’t scalable once it comes to sharing. It would provide too much friction for a lot of people

And if you are worried about Google’s involvement in this, Greyson Parrelli of the Signal team points out that the payment runs through the same zero-knowledge proof setup it uses for donations.

Looks like there is some way of decoupling the payer identity from the signal user