Aurimas Liutikas :google: on Nostr: there are a couple of layers to this. Generally, you should be able to trust a ...

there are a couple of layers to this. Generally, you should be able to trust a signature of an APK, and you can validate that on and off device. If a new APK is pushed with the correct signature, you might have a very difficult time distinguishing that from a legitimate staged roll out of a new version. Different signature APK will not install on a non compromised OS.

For checking if something is rare, you can check the checksum of an APK installed on a device or off the device.