Worth pointing out that a git repo doesn't mean that's what they're running on the server

I'm not saying don't trust Signal, but it's worth remembering that you are trusting them