Olaftio Hello !
It is generally recommended to use Sandboxed Google Play for apps that depend on Google services or that you cannot find elsewhere, please note that Google services on GrapheneOS work like regular apps in the standard sandbox without special privileges. Then there is Accrescent, which aims to become a modern, private, and secure alternative to the Google Play Store, in fact, this is probably the main recommendation, the founder is a contributor and moderator of the GrapheneOS project, then, there is Obtainium, which allows you to manage your .apk files taken from official and trusted platforms such as Gitlab and Github. Obtainium works with AppVerifier, available on Accrescent.
You can install and use F-Droid and Aurora, but yes, these are not the best recommendations, see : https://privsec.dev/posts/android/f-droid-security-issues/. Aurora uses Google services, the apps are not signed, which is a security and privacy issue, and there is no guarantee that the apps will continue to work because Aurora violates Google's terms of service. It is much safer and more peace of mind to go through Sandboxed Google Play.
For Signal, use Molly instead via Accrescent, it's a open-source fork, and you can use Unified Push with Sunup or Ntfy for a much more battery efficiency.