[CarelessExpert]

> I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?

This is mentioned elsewhere, but the answer is: reproducible builds.

You can take the Signal client source (which is available on Github), build an APK or whatnot yourself, then get the SHA256 hash or whatever and compare that to the artifact downloaded from the app store and validate that it's the same.

Has anyone done it? No idea!

[bigiain]

The signatures on app store apks mean that doesn't work.

You can though, decompile both your version and the app store version and compare them that way.

[CarelessExpert]

Any reason you can't just zero out the signatures and then hash?