Even with an open source edition it's hard to link strongly the source code to the resulting APK. How do you know that the generated APK hasn't been built with

Even with an open source edition it's hard to link strongly the source code to the resulting APK. How do you know that the generated APK hasn't been built with extra "features"? For each release, independent people would have to compile the same source code and inspect if there is any differences with the published APK. One way to make this easier would be to fix the build system so each build with the same source would provide a bit-exact APK file (without timestamps). Then the independent parties just have to check if all of the bits are the same (with a hashing function). Ideally Google would also publish the hash output of each APK so that it can be checked against another distribution channel on installation.