[mfwoods]

But you can verify that the source they publish on Github is the same that was used to built the Google Play version with reproducible builds[1]. Also, Android apps are fairly easy to decompile. They are very likely to get caught if they publish an update with a backdoor.

[1] https://github.com/signalapp/Signal-Android/tree/master/repr...

[sodality2]

Wow. That's awesome, I could have sworn they opposed to reproducible builds for some reason.

[fsflover]

Probably because of this: https://forum.f-droid.org/t/signal-wickr-on-f-droid-2021/122....