In this scheme, they don't sign the APKs – the developer does. They just verify that the APK corresponds to the source code. I don't think there's any point in

In this scheme, they don't sign the APKs – the developer does. They just verify that the APK corresponds to the source code. I don't think there's any point in adding an independent auditing thing to this – is three pairs of (automated) eyes that better than two? But of course you can do that, the tooling for verifying it is open source. (Of course, all of that doesn't work if the app doesn't support reproducible building, which is the majority of apps on F-Droid now – hence this post calling for a change)