Glad you shared this. I just got my first Android not too long ago and haven't hacked it yet, so it didn't occur to me that the modding community was achieving

Glad you shared this. I just got my first Android not too long ago and haven't hacked it yet, so it didn't occur to me that the modding community was achieving their goals by defeating Android's security model. With F-Droid, if they were to just distribute preexisting APKs that correspond to free/open-source software — like your TextSecure APK — it sounds like it would have your signature on it, and updates wouldn't be a problem. But they compile the apps themselves to let you be "absolutely sure the binary package[..] is identical to the source". So ironically, they're actually adding a kind of security feature, and it is this that takes away your ability to provide updates (they might say by design, since you could otherwise push a closed-source update to their users). Theoretically that problem could be avoided if you signed the source code, F-Droid distributed that, and any necessary compilation was done directly on the smartphone. I suppose this is impractical, but such a setup might work on Mozilla's forthcoming Firefox OS where all the apps are written in HTML5/JS. Just as long as you signed a non-minified copy of the code, it wouldn't be an issue. On the other hand, I think the problem with updates, if we're continuing the F-Droid/Debian analogy, really comes down to how much you can trust the "distro". I use Ubuntu on my desktop and if there's (say) a Firefox vulnerability, the security update for that will come from, and be signed by, Ubuntu, not Mozilla. And it works because I trust Ubuntu. They monitor high-profile applications like Firefox and if a fix is needed, they'll ship it ASAP. Whereas, the F-Droid people were apparently not watching TextSecure closely enough, and either didn't notice there was a new release, or couldn't be bothered to update their copy in a timely manner. I'm not convinced their model is inherently insecure; it just requires I put my trust in them rather than in you (in this case perhaps a questionable decision).