But isn’t this true for most services, such as Matrix as well? Nothing assures that a Matrix instance is running the exact code on git.

It’s valid for any server. But for signal messaging is even worse than the competitors because it’s centralized.

If you selfhost and they want to take your server, they will?

Correct. With signal there’s no way to escape the US government, but with matrix (or other federated protocol) you can make it harder, so it won’t be worth it the resources spent. You can also host it where the US government don’t have any reach.

Even if you self-host in a Swiss server, with the best intentions and security practices… Other people are going to have to trust you. You trust yourself, but others might not.

But who is more trustworthy? The US government or the swiss government?

Also, the point is to avoid american services. Signal is an american service.