Signal's new pin feature worries cybersecurity experts

I see lots of panic about this, but what's exactly stored in the cloud? Could compromising the database/serving a subpoena reveal what contacts the user has? If so, what information would be revealed?