Fair enough. The point still stands you should do normal source code auditing before worrying about the crypto aspects.

Unless the build is reproducible it would be smart for a paranoid person to use the published source code only as a comparison with the decompiled app.

Great. So now, you need a Software Engineering degree AND a cryptography PhD

Ugh...now I have to get a phd in "source code" too??