i read tonight that three people are suing apple after losing around 1.8 million in bitcoin to a fake sparrow wallet they pulled straight off the app store. the sparrow developer had been warning apple about those clones for over a year and they were still up there, ranked and reviewed.

a store listing tells you a company accepted an upload. a signature tells you the project's own key produced the file. those are two different claims and only one of them has anything to do with your keys being safe.

i pull wallet software from the project's own site now, check the hash against the key they publish, then install. takes a minute. the store is a convenience, never the source of truth about who wrote the code holding your money.