I don’t think Signal is unsafe, but agree that it is a weird middle ground. Depends on threat model, of course, but overall I would prefer something selfhostable - for the sake of independence, easier anonymity and censorship resistance. Plus, Signal by default doesn’t allow desktop registration (and desktops are much easier to make private than phones), so you’d need either a VM or a command-line application for it, which is a big pet peeve of mine.