> update thats infected by some government trojan?

Unfortunately you don't. But this is true for ANY app.

Fortunately, Signal is open source. So you can go read the lines of code. Unfortunately this is a lot of work. But fortunately if you believe a certain checkpoint is secure (your current install) you only need to read the new things. You can also build from source if you don't trust the app store.

Fortunately with open source you also get the benefit of others. Maybe you don't look through everything, but there's definitely other people looking through some things. And with something like Signal, you can be pretty certain that there will be a big uproar if something devious is pushed.

You always need trust, unfortunately. But with closed source you have to trust one entity and get no way to verify. With open source you have to trust very few and can even verify yourself.