Signal markets themselves as really secure. It's on them to prove that they are.

No reproducible builds from them when they are now very common is really suspicious.