Yeah, the exact way the apps are signed for the Zapstore is above my head. It's probably just a note with the hash of the app that is signed by the Nostr key. When Zapstore downloads the app to your device, it then checks the hash of what was downloaded against the hash in the note signed by the dev's Nostr key to make sure they match before installing.