[chrismorgan]

Reproducible builds make it possible. As an associated practical benefit, they also aid in making it possible to confirm that at least you’re getting the same version as everyone else, which is not something that can practically be done on mainstream mobile platforms, or at all on the web, yet which is probably the most likely form of attack (e.g. serving key-stealing code only to a subpoenaed customer, or only to one person as a rogue employee, to reduce the probability of being noticed).