Right. There is no way for me to verify that the Signal app isn't actually a trojan created by a US agency with a clever marketing team. It sounds far fetched, but it wouldn't be the first secure messenger that was later revealed to be a covert spying device.

I still use the app, because I trust Signal more than Facebook, but the encryption isn't why I trust them.