having a public on a github (or nostr git repo) can give some certainty in whonis distributing. using the same pubkey for checksumming the code as well as signing the app package and the nostr account sending it. no need for central app stores