Signal’s devs recommend that it be installed from the Play Store, and that is what the vast majority of people do. There has been heavy speculation that certain state actors are able to push a compromised Play Store update to users of interest. Moreover, the Signal board has been overhauled recently, Moxie left, and at least one new member has a US government background. It’s possible that the organization itself has been somehow compromised.
(While Signal still offers an .apk for download from its website, the organization does not recommend it. Moreover, that APK comes with its own update functionality where the same risks may exist as with the Play Store.)