Seems suspicious... I don't think they would do that without a blog post

Your right

Still no announcement... If you installed this app, you might want to go secure you signal account back, change 2fa or something. Idk. I tried searching and found only two articles about it and neither provides sources.

I found the source. The way to verify is to go to the cake site, then about then open the founder's Twitter. There he made the announcement