For all we know, Signal itself could be one big CIA operation. It wouldn't be beyond their capabilities. But at least the protocol and encryption are open source.