Both of your things depend on the client and if they are true it doesn't actually matter if the server is malicious or not.

I think the best description I've heard of Signal is it's open source "software" not an open source "project".