Even that isn't strictly guaranteed to work; have you read ken's Reflections on Trusting Trust? Strictly speaking, you'd need to hand-compile (or at least hand-verify) the app, and trust the underlying platform as well (dalvik and/or the hardware).