

In the US, I largely agree with you. Or use a website from a mobile browser. Different story in different countries where a smartphone might be the only compute the average person has, or where state services are tied to a mobile ID or bank app.
Not saying that should be the case, but if the choice is between running niche FOSS apps and removing yourself from societal benefits structures, I know what most people will pick. That’s the real danger of allowing one company to own an entire ecosystem and have enough power that they have conversations directly with governments about their people instead of with their people.
This is fundamentally not how Signal works, but you are generally correct in that a phone number has been shown to provide a lot of context for a person (or a device, at least). But Signal (the app) only uses a phone number for initial verification of an account. You have a lot of options to break that association with you - use a landline and get a call verification code, use a VoIP number (assuming you trust the provider), use a burner SIM, etc.
Once you have an account, you can choose to identify yourself on the network solely via username so the registration number is not presented to other users. The Signal protocol itself is well-audited and generally secure.
If your issue is with Signal the American company, use an open source fork like Molly with your own UnifiedPush instance. Then you’re only trusting them with transport of your encrypted messages, which again have shown to be secure at least in public audits.