>I don't think I can do anything more to guarantee that's the actual shipped code?

Not without way too much work (which would never satisfy everyone).

Reproducible Signal builds for Android | https://news.ycombinator.com/item?id=11399893