Thanks for clarifying. Even with E2E wouldn't you still want the code to be open source or an independent audit done? As I said, not an expert.
But I could also just dex2jar + JD-GUI the Android app and study the decompiled Java code to see what they're doing.
Edited to add: https://twitter.com/CiPHPerCoder/status/1042870740880637952