Safari seems to be modified

The way to determine what changed is to diff the current folder against a backup copy from when the code sign was valid.

Why could be as simple and harmless as bit rot or a filesystem error and it could be that some other tool injected code.

Unless you routinely list and checksum each file in /Applications/Safari.app and compare those results, your best bet might be to re-install the latest combo updater from http://apple.com/downloads and re-check that the binary is properly signed. If not, you might need to back up that machine and start with a clean erase and reinstall and watch to see what / when Safari gets modified going forward.