We do not build, but you're correct that you need to trust us (to provide the right hashes).

All indexed APKs are fetched from their original location, mostly from Github, this helps somewhat distribute the trust.