Zapstore signs with their indexer key all apps that are not self signed by the developer. So you trust zapstore with TOFU in this case. So if you love an app thats not yet self signed on zapstore, go bother the devs to do it, its trivial, literally half a prompt.