Privacy

Do you really think government/counter agents aren't already doing this?

Any security agency that wasn't aware of it before even we were, with projections of likely growth path, who else is looking at it, etc, etc, wouldn't be a very effective security agency.

Keep in mind that this is what I can think of off the top of my head, and I'm not an intelligence/security boffin.

Also, capitalization, punctual, etc are a thing for a reason... If you can't be bothered then people won't take you seriously. Is it really that hard to press shift as needed?

Signal Foundation is a nonprofit in California, and they are the ones that operate the relays and maintain the FOSS app. Since they're a regular 501(c)3 and not a religious org, you can look into how their money is spent (to see if it's going to any suspicious recipients) and whether they're getting suspiciously large sums of money.

On top of that, they don't have access to the communication data itself. It's all E2EE, and the app being FOSS means you can inspect how that data is encrypted and sent (and even build your own from source, if you're paranoid). Even if they're unknowingly hiring covert bad actors, it's unlikely their activities would stay hidden for long.

So while it's certainly a concern that it's still centralized messaging, it's probably one of the best options due to the easy access for most people. Other than a billionaire buyout or government laws that force backdoors into encryption, the only real existential threat they currently face is operation costs. They were fortunate to have wealthy philanthropists in the beginning, but if they have an explosion in users (unlikely), it might bring the organization to its knees.

I don't find your particular scenario to be worrisome. And if it turns out that it's compromised in the future, there's other good apps out there, like SimpleX.

You can't prove that Google isn't shipping backdoored versions of the app to targeted individuals

Signal is not a company, so in that case since it's Open Source they shouldn't be able to implement real hidden backdoors