[russnes]

Last I checked Signal has reproducible builds at least on Android, so it should be possible to verify it doesn't have back doors.

[opportune]

That only verifies that the app stores are not directly adding a backdoor to the APK. An exploit could still be hiding in plain sight within the code, or more likely added by the OS through various mechanisms like a direct OS exploit making it easy to read application memory, or the OS injecting an exploit while starting the app.