GM

Found out that the Android keystore used to sign the Termux apps is committed to their repository. Meaning that all updates are untrusted, or trusted to the release source - in this case their Github user. Most apps are predictable but there are wild edge cases.