I wonder if there's a difference between the Chromium and Google builds relating to when built-in libraries vs the macOS Security Framework is used to verify.
Hey! I think you might be on to something there. I don't know these systems all that well, but on a lark I popped open console, tried to repro, and dug through all the garbage in syslog when I did. Sure enough:
trustd | SCT is in the future: 1604195641038 > 1604195641000
Damned if that doesn't look like some sort of milisecond-precision clock and microsecond-precision clock getting into a silly disagreement, eh...?
I can also confirm this log entry does not show up for non-repro loads.... 