Tor has decentralized nodes, signal is a single central server with no verification of what’s running on it ( that also uses phone numbers, which are tied to you identity, as its primary identifier). Also as a US company it’d be illegal for them to disclose if their server has been compromised.