Very nice. I'll try to tackle this somehow. A bit more community ideas before.
Questions: I would tie this to source code, not APK. Problem is most don't do reproducible builds and we probably audit ...
Attesting a check for a commit id is correct. Reproducers can link it to binary hashes.
