True and definitely not from sources you don’t trust. Better yet… do what I did and extract the IPA file yourself using ipatool: https://github.com/majd/ipatool

Then you know it’s legit the original source. This is why it’d be great if nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s did this we could confirm checksum.