Quite a few reasons to be concerned. Moxie left Signal and at least one of the new board members has a US government background. The update methods allow issuing a compromised update to targeted users. And while Signal still claims that “in our model, the server knows nothing about users”, for a few years now users’ contacts lists (sweet, sweet metadata nearly as valuable as the messages) have been uploaded to servers, protected only by the notoriously vulnerable Intel SGX technology.