They should make reproducible builds mandatory and then sign over apks built by devs. That way they don't have to be trusted specifically and that's how it must be.