Are you using GrapheneOS servers?
Updates, ntp etc?
If yes it's better to be in the Ocean with other Google users. 

 Hahahaha
Behind on quantum resistant.


Focus on metadata. 

 Have you checked their server side code?
Content of your messages is not important.

The real value is metadata.
 

 Even their app code is not open-source.
You cannot reproduce their build. 

 Unfortunately I cannot agree. From operational point of view metadata of regular users are more useful.

For valuable targets you can use more sophisticated tools to obtain content of their correspondence.

Metadata can expose what are you doing, where, with whom, the whole social graph.

You can acknowledge intensity etc.
 

 Signal is not even open-source. 😢 

 πŸ€£πŸ˜πŸ˜‚ 

 DivestOS has own instace of F-Droid  and they have .onion address to use it via F-Droid app.
They have 3 mirrors within Tor (onion addresses).

If you have no time to customise GrapheneOS or other custom rom just don't use it.

It' safer for your personal data to use Iphone (consider lockdown mode) or Pixel with stock Android. 

 "A few positive things about Signal. The applications are open-source"

It is not true!

You cannot reproduce Signal build.