Hi,
I share your skepticism about poorly implemented encryption mechanisms being marketed as 'secure'. But I do lack the technical capabilities to assess implementations. The Matrix-protocol says it has solved the problem as well, and once the Oauth integration is complete, there is no more need to use a (central) identity-server. That looks to me like an even more secure system than Signal's - or am I wrong?