“Debian, for example, has been working toward reproducible builds for more than a decade; it can now produce official live CDs of the current stable release that are reproducible.”
Fedora wants 99% reproducible packages by Fedora 43 and is already at 90%. The point is catching a compromised build server. The guidelines would say should, not must. Nobody has said who runs the verification service.