The problem with signal is that of any application running on a third party server, no matter if they publish their code on Github, you will never know what they run on their servers, so it's all a matter of trust.

This is why no intelligence agent will use a VPN over Tor.

And this is why SimpleX is so important, because you decide who is your receiving server to which the sender will connect, as if it were an email server, and setting up a Simplex server costs 5 minutes.

Hosting your own SMP Server