Comment by tcd

This is why it'd be nice for the APK/installable file to have a hash that can be verified against an open source version. In theory someone should spot anything that doesn't look right.

But that can't/won't undo the effects of something being called "private" being exposed not to be afterall...