Well with those two sentences you've pretty much ensured that this is never, ever possible. You'd have to have a trust system from the silicon up, signed bootlo

Well with those two sentences you've pretty much ensured that this is never, ever possible. You'd have to have a trust system from the silicon up, signed bootloader, hypervisor, no exploits, etc to guarantee that the system you're booting is executing the binaries you think it is. At some point "good enough" has to be enough. Okay, you built the APK, how do you know I don't control the VM and just swap out that JIT'd method with one that I've altered? (Repeat this until you get all the way back to the initial power-up)