Signal comes from the country where the Prism [1] is still functioning. While it has open source, NSA can request from deployers on any stage to inject surveillance functionality: request from Signal authors, from Android / Apple Store repository maintainers and probably many other actors on the deployment chain to my mobile phone.
I could install it from sources but I do not have any guarantee my message sent to my friend is not eye-picked by PRISM on his phone.
Open-source + marketing copy != final product
Just a regular reminder, guys.