Regarding metadata, you may want to read the FAQ.

It will have forward secrecy after they finish implementing Autocrypt2.

A person also has to determine their security threat level. If they think a state actor may take a personal interest in them, then they're probably best using in-person offline communication. If they must communicate online, then IMHO I don't think Signal is a good choice due to it being centralized (everything goes through their servers, and they are a single entity making them easier to infiltrate or coerce by governments) and requiring you to link a personally identifying number or credit card.

If they just don't want a corporation datamining them to sell to advertisers, Deltachat is more than good enough.