This isn't something you can reasonably protect against and I don't even see this as a purely technical problem.
Even if you could verify Signal, what about the OS being compromised, the phone being lost or a shoulder surfer reading the message?
Even if I tell a friend a secret over dinner I can't 100% verify that they are not going to tell someone else. So some degree of trust in the other party is required.
If you can't trust the person to take the technical steps needed to secure the information, why do you trust them to not just share your secret the old fashioned way?
Knowing that your client isn’t compromised is pointless if you friend can’t/won’t do verification on their end.