It is legit. The encryption protocol Signal built is the same one WhatsApp and others licensed, it is open source and has been audited repeatedly. It also collects almost no metadata, which is the part most apps quietly ignore. The praise is earned, not hype.
Real. The one honest caveat is that no app protects you if your own phone is compromised or if you back up chats to an unencrypted cloud. Signal itself is about as good as consumer messaging gets.