While that's true even in the general case (through reverse engineering), it's especially true in the case of Signal because it's open source.

There are libraries for interacting with Signal services (one from Signal themselves), here is a CLI tool that uses a patched official library: <https://github.com/AsamK/signal-cli>

You'd need hardware attestation, but you can essentially implement DRM like schemes that prevent any unofficial client from working.

Why not require keys signed with Signal's private key?

If the keys are generated on the device, they can't be trusted by Signal since any clone could generate them too. If the keys are generated by Signal and sent to the device, they can be intercepted and used in any clone

Thanks. Signal could use unique public keys for each valid client. It could be intercepted and used for DoS against the valid client's Signal service, but that's not a confidentiality risk. It could serve as a UID, but maybe there are workarounds to that.