How about the following? "Sure, we do use the precompiled binaries. We can even prove it because they have the same hash, and our procedure fails if they don't

How about the following? "Sure, we do use the precompiled binaries. We can even prove it because they have the same hash, and our procedure fails if they don't" How you obtained your binary is immaterial, if you can prove it's the same as the audited one. Surely regulatory people would accept that?