

Since @angband@lemmy.world added more to the comment with an edit:
- The Signal mobile app is open source, anyone can read the code: https://github.com/signalapp/Signal-Android
- There is also Molly, which is on F-Droid: https://github.com/mollyim/mollyim-android
The source code does not contain anything that would let someone break in and read your messages. That part is irrelevant.
Assuming @angband is asking about a scenario where Google is compromised and tries to push out a bad APK to update over installed apps to read the private data stores, see here: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md
Signal has supported reproducible builds since Signal Android version 3.15.0, which was first released in March 2016. This process lets you verify that the version of the app that was downloaded from the Play Store matches the source code in our public repository.
So if they pushed out a bad update to lots of people, it would get caught pretty quickly.
Now if an individual is worried that they are high profile enough to be targeted as an individual, they really should be installing from a source other than the play store.





























What you’ve described would affect any app on the play store, unless you have some other concern with the signal protocol itself?