Signal's current UX seems pretty good to me, and it's not even that easy to lose the account

> open source

I'd just stress that at least for the Android client it's open source with some degree of quoting: the real git history is not shared (each release typically consists of a single huge commit), and the source is often published weeks after a release of the official client.

The server is also not open source, but that's not very relevant for security.