Signal is an app whose distribution is controlled by the same people that say they don't have access to your data.

They could at any point push an update that decrypts your messages locally and pushes them decrypted to a server. The only way to prevent this would be to verify each binary update to signal matches the source code, and no modifications have been made to the source to do this.

Is that part of your "signal update" routine?