&gt; Getting access to Google Play throughout the regular route implies getting closed stuff from Google into your phone...<p>IIRC, getting access to software through the F-Droid marketplace <i>explicitly required</i> (at the time the big discussion was made (~3 years ago)) users to expose themselves to the risk that a compromise of F-Droid&#x27;s <i>online</i> signing key (that -IIRC- wasn&#x27;t even contained in an HSM(!)) would open them up to silent replacement of any and <i>all</i> software installed through F-Droid by the attacker. Note that &quot;the attacker&quot; could <i>also</i> be &quot;anyone associated with F-Droid&quot;.<p>Despite what one might think about their for-profit datamining, Google has a <i>really</i> good track record with regards to the nitty-gritty of computer security.<p>When Moxie looked at what F-Droid provided, it was <i>entirely</i> inadequate to securely distribute software to TextSecure&#x27;s target audience. Because TS&#x2F;Signal is not currently officially distributed on the F-Droid market, I have to assume that it still cannot provide what is required to securely distribute Signal.<p>And, to top it all off, the F-Droid folks are so lazy that they write things like this:<p>&quot;The latest version of the application is 0.6.2, and the security flaw has now been fixed. However, the author has not published any source code corresponding to the binary he released of this version, and far from wishing to help anyone stuck with his previous disastrous mistake, he actually asked for the application to be removed from our repository as he wants to distribute it via Google Play only.&quot; [0]<p>TS&#x27;s source has been distributed via GitHub for <i>ages</i>. The version that the F-Droid guy <i>says</i> didn&#x27;t have publicly available source at the time of his post appears to have been published for <i>two weeks</i> prior to his post. [1] If the guy who wrote that blog post is still in a position of responsibility at F-Droid, I don&#x27;t trust the organization to pay sufficiently close attention to detail to package <i>any</i> security-critical software.<p>[0] <a href="https:&#x2F;&#x2F;f-droid.org&#x2F;posts&#x2F;security-notice-textsecure&#x2F;" rel="nofollow">https:&#x2F;&#x2F;f-droid.org&#x2F;posts&#x2F;security-notice-textsecure&#x2F;</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;WhisperSystems&#x2F;Signal-Android&#x2F;commit&#x2F;f6660dbef51ec061f6e4f449e6238014d55fcda0" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WhisperSystems&#x2F;Signal-Android&#x2F;commit&#x2F;f666...</a> [2]<p>[2] And the initial import date on the GH repo jives with the date on the notice that TS had been released as OSS. [3]<p>[3] <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20111225144326&#x2F;http:&#x2F;&#x2F;www.whispersys.com&#x2F;updates.html" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20111225144326&#x2F;http:&#x2F;&#x2F;www.whispe...</a>