Cool, that's a good approach. I was a little confused because their FAQ describes trust in a Zapstore indexing key, which sounds like trust in something server-side rather than client side. I'm still a little confused where that comes into play. If the client verifies the dev's signature and shows it you so you can verify matching npub yourself, that would definitely mitigate any server side trust.