Open source does not mean your binary is secure. There are too many counter-examples of this fallacy to even bother enumerating. These widely- distributed binaries will be torn apart and inspected instruction by instruction. That is the only way we will know for sure, and you can bet people will be watching closely going forward. In this case I think lack of open source is not an issue given the reality of the distribution system.

> Open source does not mean your binary is secure.

Open source is necessary - not sufficient - for security. Other work has to be done. With closed binaries you can't even begin that work.

Is the backend for the Signal's messaging server open source? If so, they should open source the build script too.

I believe so: https://github.com/WhisperSystems/TextSecure-Server