Good point, and true there are few reproducible apps.
Would be nice to tag a version (as per Software Applications NIP) against which the latest analysis was run, rather than a git commit.
These reports also contribute to reputation to the keystore/certificate signing the APK so they help anyway.
