Oh, I see your point. But generally, I tend to trust the developer isn’t going to put out a binary that is different from the source code they publish. My chain of trust would be, fdroid, being the best, the developer, binary directly, being second, and open source, and then something like Google Play with closed source crapware.