I'm guessing we can still use the existing obtainium set up with github to get updates until further notice.

There isn't a spec for releases over nostr but imagine having the release you are installing signed by the developers via nostr? That would be an upgrade from the current obtainium trust model, wouldn't it?