If the messenger is not open sourced, it's trivial for Facebook to add something to the client binary (now, with a flag or at some later date) before the Signal

If the messenger is not open sourced, it's trivial for Facebook to add something to the client binary (now, with a flag or at some later date) before the Signal libraries are hit. I'm not saying they are doing so, but without a clear way to verify continually, this is just short of security theater. Then there's Facebook facilitating the key exchange which of course is another blind trust as well as all the juicy meta data. Maybe this will quiet some of the nerves of privacy conscious individuals already on the network, but it seems to me more like a marketing label. I still find it hard to believe so many people trust what they believe to be private communication with close-lipped advertisement companies.