>> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. > 1. The Andro

>> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. > 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device You missed the and private keys part of the original claim.