I didn't mean to imply Signal wasn't open-source, just that it was based on TextSecure and can be forked.

If the commercial entity fails or is held liable, we just need a distributed profile system, should be easy enough.