I just read the full article, and I'm not even that concerned about storing the key in plaintext. I find the possibility of copying the files, and then being able to run the same session simultaneously a lot scarier.
With what? Where would you store the encryption key for the encryption key on a desktop system where it would not be accessible to an attacker?
Perhaps there could be a pin or password that must be entered every time to decrypt it into memory.
As the article states, currently all processes are able to read the file which contains the key. Instead, you could store the key in the macOS Keychain (and Linux/Windows equivalents), which AFAIK is a list of all sorts of sensitive data (think WiFi passwords etc.), encrypted with your user password. I believe the Keychain also only let's certain processes see certain entries, so the Signal Desktop App could see only its own encryption key, whereas for example iMessage would only see the iMessage encryption key.
Wifi passwords are piss easy to read out well at least on windows.
Only if you're logged in as an Administrator though. A "standard" user account can't access WiFi passwords on Windows.
While true I don't get why this is long known and also news at the same time.
For Signal Backup tools for example this isn't a bug but a feature and the only way to make long term archival of chats possible.
If your computer is compromised to the point someone can read the key, read words 2-5 again.
This is FUD. Even if Signal encrypted the local data, at the point someone can run a process on your system, there's nothing to stop the attacker from adding a modified version of the Signal app, updating your path, shortcuts, etc to point to the malicious version, and waiting for you to supply the pin/password. They can siphon the data off then.
Anyone with actual need for concern should probably only be using their phone anyway, because it cuts your attack surface by half (more than half if you have multiple computers), and you can expect to be in possession/control of your phone at all times, vs a computer that is often left unattended.
