Pretty sure if Signal was compromised it would have been discovered a long time ago given that it's open-source. My guess is that CZ got pwned.