In the case of Android the approach we use is to compile the apk ourselves and then compare the results. Comparing involves unzipping both apks and then comparing file by file. This is necessary as zip compression can result in different bits depending on the version of zip being used but the uncompressed data matches. We also use diffoscope that provides more insight into signing blocks that are in parts that normal zip tools might ignore. A different approach is to compile the app, extract the signature from the official app, add the signature to the compiled app and then verify the signature. If it's valid, the file is reproduced with only the signature coming from the official file.

In the case of hardware wallets, the signature is typically a block of binary at the start or the end of the file, too. We shift the burden of verification if other stuff might reside there and do harm to those that do actual code audits, which we do not provide at this point. 

 Great work, thank you! In the meantime was just browsing your page for Aqua wallet: https://walletscrutiny.com/android/io.aquawallet.android/ 

 Yes, the app is quite popular for such a young product but not huge yet neither. I guess they'll figure it out soon. Looking forward to seeing it reproducible.