You'll note that logically a company cannot actually solve this problem themselves in a satisfactory way, since you would have the same problem trusting the ver

You'll note that logically a company cannot actually solve this problem themselves in a satisfactory way, since you would have the same problem trusting the verification mechanism as you did trusting their app in the first place. What you want belongs as an operating system or app distribution mechanism concern. A third party OS extension might make sense. Even that's a bit fraught if there is any kind of dynamic code execution (aka code that appears at runtime, say, a web view).