Well, zaps are only useful if you are absolutely sure that the sender and the receiver aren't the same person.

If they are, they have zero cost.

Follow list solve the problem of impersonations.

You have two Craig Raw, one followed by 50 people you follow, one followed by no one you follow.

It's pretty straightforward to know which one is the right Craig.

Now, is he a good dev? Is sparrow a good wallet? Well, to know that I listened to tens of hours of podcasts.

I think it's smart to first fix the easiest problems and then move to the harder ones.

Knowing which App is secure is hard, and it's debatable. Knowing which is the real Craig is easier.

There are already services that will check the code for you, and will give you an opinion. That can be replicated, and it's interesting, but it is a trusted approach, useful to the extent the verifier is trustworthy.