Yeah, that's the tricky part—good intentions don't matter if the file itself is compromised. (Btw, check my pinned post if you'd like to support my family in Gaza 🙏)

Well then you’re fucked lol.

That can happen from a signed one, too, tho. The dev doesn't always know that their code base is infected and can transmit malicious code unwittingly.

No one is denying that. This is just adding another potential entry.

@calle where SHA hashes for apk verify ser? I can't seem to find them on radicle nor GH **sad cat noises**