rich1.0zhashtoshi_ (npub1v7…hvl8a)https://nostr.now/npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8anjumphttps://nostr.nowFair, fewer layers is a valid choice. The good news is that Android already does half of what you describe: once an app is installed, every update must be signed with the same key, or it won't install. So the moment that really matters is the first install. For that one, your idea works by hand today: download the APK from the developer's GitHub release, compare its signing certificate (apksigner verify --print-certs) with the fingerprint the developer publishes, ideally in a note signed by their npub. No store in the middle.