There isn’t any proof that the app you download is built exactly from the source code on github.

In principle, this statement holds for any app that you don’t compile yourself. As we’ve learned from the xz disaster last year, even the dource code versions on GitHub don’t have to match.

There are at least two Signal versions: The official version, the one from the Guardian Project. For the latter I assume that they build from the publicly available source code. And then there is at least the fork Molly.

What part am I missing? They seem to have the source code of their server and the different apps on their GitHub page.

Your picture shows a blade. A blade is a server…

However, that wouldn’t be good for the fragile ecosystem in the Baltic sea.