F-Droid can also redistribute the signed upstream APK. The requirement for that is that the build is reproducible. This is the best of both worlds because the

F-Droid can also redistribute the signed upstream APK. The requirement for that is that the build is reproducible. This is the best of both worlds because the distributor (F-Droid) verifies that the published source matches the binary but does not possess the private key to sign the APK. This means the distributor cannot push a backdoored binary blob at some later date.