During the bootstrap phase only this nsec is signing releases but I'm building tools for developers to sign their own. Since there is no centralized source of truth anyone can claim an app is theirs, hence the importance of the social graph to establish trust and weed out scammers

Replies (4)

I think this is a novel approach that does not exist on centralized appstore or play store. For instance @npub16r0t...z5pl can submit an app repo for @Zapstore consideration, and review. Placeholder feature request:
But it would be cool to also include apps where their devs don't know/care about nostr. I was thinking of something like the Arch User Repository (AUR) where users submit packages that are not theirs and it's up to other users whether they trust it or not.