Also the first install is validated by the devs on nsec, so I guess you trust zapstore to not have bugs, but the idea of the code is that it validates the actual devs signature which you can compare to your social follows. Then regular TOFU kicks in for android protection

Cool, that's a good approach. I was a little confused because their FAQ describes trust in a Zapstore indexing key, which sounds like trust in something server-side rather than client side. I'm still a little confused where that comes into play. If the client verifies the dev's signature and shows it you so you can verify matching npub yourself, that would definitely mitigate any server side trust.

Zapstore signs with their indexer key all apps that are not self signed by the developer. So you trust zapstore with TOFU in this case. So if you love an app thats not yet self signed on zapstore, go bother the devs to do it, its trivial, literally half a prompt.

Awesome!

you can use the same spec that zapstore uses to have your apps auto-update from nostr. that's what damus does. don't need to rely on them at all.

Eventually @Zapstore can (and should) let you use your own Point of View's web of trust.

Well that sounds dope, cool

Exactly this, but I will add that you are prompted to verify the download URL, which in many cases is the developer's Github. So github user/repo comes comes into play there too - which is exactly what Obtainium does.