It's not great. But I prefer it over the risk of downloading an APK from signal's website that I don't know how to properly verify the integrity of (there's a key listed on the website, but who knows if it's correct?). (I don't use Google play)
https://github.com/privacyguides/verified-apps-android
https://github.com/privacyguides/verified-apps-android