You have signatures on the apks, the OS won't install if it's with a different key. So only first time problem - but that's the same with zapstore, unless you know the author's npub. BTW: Obtainium has many sources, including just plain web URLs, not only github. I guess it could even search zapsto...