Debian has reproducible builds. What about PureOS?

Right, that is a nice feature, but that does not remove the trust-the-entity(repo) model.