> Not possible to verify as application is closed source. Maintainer could compromise security at any time without detection.
I think it's useful to have this differentiation, even though technically you could say E2E is TRUE for both of these.
For each release, independent people would have to compile the same source code and inspect if there is any differences with the published APK.
One way to make this easier would be to fix the build system so each build with the same source would provide a bit-exact APK file (without timestamps). Then the independent parties just have to check if all of the bits are the same (with a hashing function).
Ideally Google would also publish the hash output of each APK so that it can be checked against another distribution channel on installation.
Technically one could still argue the same for Telegram unless you're self-building given their source-release delays but that might be nitpick too far.