I don't need the source code for Facebook.com to know what information my open-source browser sends to it. Same concept with Signal, you can read the client source code to know what the protocol sends to the server.