Aren’t the apps reproducible? Meaning, if the open source part does not match the binaries the it could be a canary for compromise.

Mind you, the last time I looked there are not alternate implementations of the signal protocol and even the usage of libsignald was frustrating due to continuous backwards compatibility breakage. I would love for a proper libpurple implementation.