"The protocol has a good reputation, problem is that you can't tell that the app is identical to the source" Don't they have reproducible builds?