They need the Tor lib to use reproducible builds first. So, I think a PR to the lib itself is needed.

Then the Tor lib binaries must be removed from GitHub and put into some other system, because GitHub is evil according to them, and they don't allow dependencies to be loaded from GitHub directly on F-droid's build system.