I feel this would require developers to post sha256 in repos. Otherwise how would you know you didn't get a fake apk with its own sha256 not knowing the difference?