Fair, fewer layers is a valid choice. The good news is that Android already does half of what you describe: once an app is installed, every update must be signed with the same key, or it won't install. So the moment that really matters is the first install.
For that one, your idea works by hand today: download the APK from the developer's GitHub release, compare its signing certificate (apksigner verify --print-certs) with the fingerprint the developer publishes, ideally in a note signed by their npub. No store in the middle.
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-23 13:28:29 UTC
in reply to nevent1q…ga3u
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-23 13:28:29 UTCEvent JSON
{
"id": "b714903079259cbe34460d3dd74ce565cae75b5b6a75b2a079393b279fca869c",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792762109,
"kind": 1,
"tags": [
[
"e",
"ba1d917c5efc068931ba5e8a18a0fa5455225c50b1372b6858b498e96e2f7bbd",
"",
"root"
],
[
"e",
"ac497f275f6c2d117f0322ddbc3a89862268a448b3f85ede3215fca1358ae3de",
"",
"reply"
],
[
"p",
"99a391add0b9d35221d91cc3cc3a0cf463176aaefbedfa6eb5f3f272feb8155c"
],
[
"p",
"67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1"
]
],
"content": "Fair, fewer layers is a valid choice. The good news is that Android already does half of what you describe: once an app is installed, every update must be signed with the same key, or it won't install. So the moment that really matters is the first install.\n\nFor that one, your idea works by hand today: download the APK from the developer's GitHub release, compare its signing certificate (apksigner verify --print-certs) with the fingerprint the developer publishes, ideally in a note signed by their npub. No store in the middle.",
"sig": "c4f97d3310e8bbbcbe66ab0f96f47ae61a403c4367297628ea491f0b1a700e805ae4cc2c877586f88bc6b2f5d58d43ced71c8f14be2ef9cde732c14a3fe17051"
}