Assuming one did have reproducible builds, would you even need signing keys anymore? All you would need is to build the app yourself or have some trusted third

Assuming one did have reproducible builds, would you even need signing keys anymore? All you would need is to build the app yourself or have some trusted third party build it and verify that both outputs are the same. You could also use md5s published by the developer and check that against the f-droid build. It seems like the advantage of signing is pretty small at that point. At least in the case I am thinking of, where the developer is using GitHub, it seems unlikely that a malicious actor would be able to add malicious code to the repo and create a new release but somehow be blocked by the signing keys. In that case, I think it would be better to just use "00000000" as the signing key for all apps (8 character minimum jks length) to make build scripts more reproducible, ie. the signing is part of the build script, which also makes apk md5 comparisons easier. Am I missing something?