It's ludicrous that you need javascript enabled to download a secure messaging app.
$ curl -s https://updates.signal.org/desktop/apt/keys.asc | sudo apt-key add -
$ echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" | sudo tee -a /etc/apt/sources.list.d/signal-xenial.list
$ sudo apt update && sudo apt install signal-desktop(To be a bit more explicit: searching for either the pub (57F6FB06) or sub(0E46390F) keys on hkps.pool.sks-keyservers.net returns no result)
If you(r system) trust the certificate that https://updates.signal.org/ is using, you should be confident that you are getting the correct keys.
(You shouldn't trust a stranger on the internet, but I am getting the same keys when I download them.)
It's ludicrous that you can't download a security-focused app when your browser settings are unusually secure. ;)
Security is about threat models: if you don't trust the code they write on their website, you shouldn't trust the code they shipped in the app.