> Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature. They do reproducible builds star

> Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature. They do reproducible builds starting from publicly available source. Given the AOSP design where code signatures are mandatory and updates are only allowed if signed by the same key, they're taking the best feasible approach.