How would we know? The signal app as most people understand it cannot be built in a reproducible manner. This means that most people will be using something that may as well be compromised. The author does not care. It doesn't matter what the source code behind it is, as an entity signal is hostile to everything a good messaging app should be.
The Java classes making up the application proper have had reproducible builds since 2016 [1]. The Play Services Signal relies on don't, but there are open source alternatives.
