Yeah the logic of the article seems absurd to me. The hypothetical problem applies to any client. If the open source software Signal cannot be trusted, how do you trust any other software you are using? It’s not the software problem , it’s the problem of the build and distribution of the software. As mentioned in other comments, you can use trusted build and distribution channel. The worst you can do is to build by your own if you want to be really safe. I have done that and it’s not so hard .