You have signatures on the apks, the OS won't install if it's with a different key. So only first time problem - but that's the same with zapstore, unless you know the author's npub.

BTW: Obtainium has many sources, including just plain web URLs, not only github. I guess it could even search zapstore if needed. That would be a cool project.