If you build a house on sand, it doesn't matter how well built the house is, it has a weak foundation.
You talk about don't trust verify but I'm using an open source OS, an open source app store, and open source apps.
You are putting an open source app on a closed source OS running on a locked down device you have no control over.
It is you who isn't verifying before you trust because you can only verify Damus. But if it runs on top of a locked down closed source OS, what does it matter?
Every element of my software stack is open. Only one of yours is.
You are trusting without verification.