Sure you should be suspicious. You should always be suspicious. Especially if it's free. And you can do something to calm your suspicions. Like checking out Signlas Open Source code.
How would that calm suspicion if you're not arr/ign-orant and understand that continuous security audit is practically impossible at an individual level?
>Like checking out Signlas Open Source code.
What's preventing them from serving a backdoored version? xz was open source as well, that didn't stop the backdoor. There might be reproducible builds on android, but you can't even inspect the executable on iOS without jailbreaking.