Interesting observation. Signing with another npub could also be offered for a specific area of an app, so as not to override actual user customizations.

WoT alone does not suffice and that's why since Madeira we've been talking about having other trust indicators like

- Certificates, domain names or valuable namespaces (like the github link we show on zap.store when about to install); domains could also be used as authority to point to a PGP key or certificate an app is signed with

- Curators and external verifier services (which might have an non-nostr reputation, i.e. a known brand, Wallet Scrutiny comes to mind for reproducible build attestations)

- Permission restrictions (do you care about the internals of your keyboard app if it's totally restricted to the network and other apps at the OS-level? Worst case you don't enjoy it and uninstall)