OK, potentially dumb, non-educated non-programmer comment here, so please be kind

One of the points he makes is that it's not possible to tell if a Signal client is actually made from the source code in question. Is there no hash-based way to ensure that isn't the case? I know that producing code which self-reports wouldn't work (as the 'altered' version could just report the correct hash, as it were), but is there no way to have a third-party app which would produce hashes of installed APKs, and wouldn't be open to such? Or is it always possible to alter that app so that it self-reports correctly, even though it's lying about the hash of the signal app?