A user that is prepared to access the apk can verify the signature of the app they have on their device.<p>(So the compromise of F-Droid that results in a signed, compromised binary can&#x27;t happen on Google Play, the apk is signed before it is sent to the store)