Signal’s defaults are pretty good about that. Push notifications are both opt-in and the information they send can be selected by the user. You can have it say “new message” and that’s it. Or the senders name. Or the whole message.

I agree that it’s not intuitive that that’s a leak to most people, but push notifications are kind of wonky how they work.

No matter how good the protocol or client encryption, your privacy is only as good as your own physical security for the device in question.

Given that if you lose your private key, there is no recovery, I would be surprised if there were real back doors in the clients. Maybe unintentional ways to leak data, but you can go look for yourself: https://github.com/signalapp/Signal-Android

They have one for each client.