Signal is not distributed outside Play store and signal own website. If you downloaded from F-droid, its probably from Guardian repo.

If you download it from play store, signal will update through play store. If you download it from signal, it will update through itself. If you download it Guardian repo, it's basically the same downloading from signal website, it will update it self.

The thing you can do is just basically turn off the update notification and just update it from guardian repo. Or just disable the guardian repo and let the signal update itself.

My signal app tries to update itself. Installed from obtanium. It is a very irritating process, the thing tries to update, there is sometimes weird response times from clicking it (you click the notification and simply do not know if something is happening) and then without notice the thing restarts and then usually it works. But sometimes, the update notification still comes back. Because of that, I just update via obtanium

If you trust the initial install then unless there is a warning about the signing key you are good. Only signal devs can sign the builds so if you installed the play store version then updated with their standalone apk or fdroid version then it should just work as the signing key is the same.

Guardian project are just publishing signals apk files as the signature matches.

You should consider using Molly, a fork of Signal with Unified Push.

Not native Signal but it happens with Signal forks that I install after adding repository to F-Droid, I have had a notification of a Signal update, even though I'm not using native Signal.

I disable that notification in the phone app settings and wait for an F-Droid notification of an update to install.

Not clear on where you installed it from...?

I have the one installed from the Play Store, and it hasn't done that. It sounds potentially suspect.

I have not had this happen. I just have the Play Store one.

My Signal auto updates via Obtainium. That is outside of a store. I think I remember the two updates your talking about.

I have one device where I installed the APK straight from Signal themselves. That is the only device where it has updated itself.

My other devices all use the Play version through Aurora Store, and always updates through that.

Maybe there's a config/setting somewhere?

But also, maybe don't use F-Droid for apps regarding privacy.

https://privsec.dev/posts/android/f-droid-security-issues/