Not allowing incoming connections from anything besides their signed app.

Signal probably ties message encryption to client authentication. You could give the 'federated' server your plaintext and encryption keys which acts like a client app on your behalf, but that obliterates the purpose of Signal and E2E messaging entirely. And still, they can ban your server IP at any time at their discretion. Maybe you can try to create a federated server that acts as one user but publishes an authenticated encrypted message on behalf of a different user, but there's no api for that... exactly the api that is being asked for in these requests to add a federation api.