> I get how it might be done in theory but real life is complicated. Has anyone attempted to do this? This is mentioned elsewhere, but the answer is: reproduci

> I get how it might be done in theory but real life is complicated. Has anyone attempted to do this? This is mentioned elsewhere, but the answer is: reproducible builds. You can take the Signal client source (which is available on Github), build an APK or whatnot yourself, then get the SHA256 hash or whatever and compare that to the artifact downloaded from the app store and validate that it's the same. Has anyone done it? No idea!