Theoretically it would be possibly to publish a reproducible compile chain, and as long as required provider secrets are provided separately in the package and

Theoretically it would be possibly to publish a reproducible compile chain, and as long as required provider secrets are provided separately in the package and read in, and there was a way to checksum individual binaries on Android, that would be an interesting step towards providing assurance of what your phone was running while still allowing them to retain maximum control of the source. I understand that's a lot of "ifs", but even if it was fully open source, it's hard to use it in anyway that's scale-able, since hardly anyone wants to compile it themselves, and hardly anyone can get it on to their phone by themselves in some ecosystems It sure would be nice to have some process to ensure my phone was running what I thought it was, even if it required publisher opt-in (and even if it requires I trust the phone OS).