Strongly agree. I would also add that even if you as an app developer are not a malicious individual who would help law enforcement persecute political activist

Strongly agree. I would also add that even if you as an app developer are not a malicious individual who would help law enforcement persecute political activists, Google will certainly give away all info it has on the persons who downloaded the app, and may as well publish targeted binary updates without anyone's knowledge, which is frightening. On F-Droid on the other hand, the recipe is open source and the build process is automated and reproducible. That means if your threat model requires it, you can setup your own F-Droid build server and only download from it and/or verify all checksums of packages published on f-droid.org repo. Outside the Android ecosystem, that's precisely what GNU/guix project is doing with the guix challenge command: https://guix.gnu.org/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall...