Thanks for your work (as this can't be said too often)

Unfortunately this is a moving target, depending on what you define as your trust anchor.

Is your anchor the original Team? Fdroid with the (reproducible) build? Something else?

depending on the answer, the "good" solution is probably different from mine