You can use firejail or other sandoxes with any application packaged in any distribution.

Radicle has plenty of red flags, see https://lemmy.ml/comment/8982169

I did the survey but please would you mind identifying yourself and linking to the research paper when it's ready?

signal is designed not to trust the server

Unfortunately this is not enough. A malicious Signal server can mount a timing correlation attack and infer the social graph of an user. Having a centralized server makes it more difficult to mitigate such risk.