This is what F-droid does (well, I suspect most apps don't have reproducable builds that would allow 3rd-party verification), but Signal does not want 3rd-party builds of their client anyhow.
They could still figure out a way to attest their builds against source.
They could still figure out a way to attest their builds against source.