Two people being able to build the same source and get the same result, does not mean the source that was built was the same source the developer originally contributed. Signing git commits would be a great start, easier than what other distros do to solve the same problem. With reproducible builds in place, the biggest remaining risk is someone tampering with git history.
Also packages being built by a central party is actually a problem. What stops someone with ssh access to the build systems from tampering with the results?
Also packages being built by a central party is actually a problem. What stops someone with ssh access to the build systems from tampering with the results?