Isn't that precisely the same way it works on a normal GNU/Linux system, though? Packages are compiled and signed by Debian or Red Hat (or whatever distribution

Isn't that precisely the same way it works on a normal GNU/Linux system, though? Packages are compiled and signed by Debian or Red Hat (or whatever distribution you're running), not by the original developer, and that's perfectly fine – in fact better, because there's some level of quality control being performed by the distribution packagers. Just like the F-Droid packagers.