> Couldn't someone just build that Signal APK without spyware and then get it signed/verified by Google?

The Signal CEO aid that they would pull out entirely from the EU if Chat Control comes to pass.

> Unless Google might not be willing to approve this alternative version of Signal, but is there any indication of that?

In this scenario, Signal will still be allowed to be distributed outside of the EU so you could get it from the Play store hosted out of the EU.