https://ci.debian.net/packages/a/apksigcopier/unstable/amd64/72115554/ and
confirmed locally:

 + apksigcopier compare NewPipe_v0.21.0.apk org.schabi.newpipe_966.apk
 DOES NOT VERIFY
 ERROR: APK Signature Scheme v2 signer #1: APK integrity check failed.
CHUNKED_SHA256 digest mismatch. Expected:
<647ed7a031902520b13c810fd292ee70e426338290be1ba043c67f80c25d3720>, actual:
<d89fb3f20914ba51325ca8cba40d8b79dfea145e1aa7c91bd10a058accf81433>
 Error: failed to verify /tmp/tmp1mi1vi6a/output.apk.

Modifying the source a little, so that output.apk is persistent. Then run the
test on trixie and on sid.

Uninstall apksigcopier and apksigner (both tools are used by diffoscope if
available and will result in having a message similar to the failed autopkgtest
displayed by diffoscope..

Use diffoscope to diff the output.apk from trixie and sid shows that one bit in
a repeating header is set in the sid version, that wasn't set before.

Since the source-code of apksigcopier and apksigner didn't change since trixie
the bit in question seems to be set by sth. from pythons stdlib.

Rewriting those headers is quiet magical [0] need to investigate more on this
next week. Just wanted to share the current findings.

If someone with more experience about the apk package format could help, this
would be more than welcome.

[0] https://sources.debian.org/src/apksigcopier/1.1.1-1/apksigcopier/__init__.py#L465