I neglected to mention that the first time you install Signal it should come from a trusted source (e.g. copy it from someone who is happy to use the play store), then updating via apkmirror is safe, since the signatures will match.
Also this might be useful a desktop play store client: http://www.onyxbits.de/raccoon