There isn’t any proof that the app you download is built exactly from the source code on github. There could be an intermediate step to inject whatever they want before packaging it for the app stores.

There’s also the conspiracy that Signal has been compromised since the beginning as they received initial funding from the CIA. Not sure exactly where I stand on this, but it is plausible.

The protocol itself is open source though so someone could make an open source service with that.