Which you a) don't even have to do https://signal.org/android/apk/ b) can pull from your phone to compare the apk hash against reproducibly built client.

Open source is not panacea, but it's a requirement for verifiable security.

So how about you show us that either the play store APK doesn't match, or, that the source has the backdoor you claim it has.