Very nice. I'll try to tackle this somehow. A bit more community ideas before.

Questions: I would tie this to source code, not APK. Problem is most don't do reproducible builds and we probably audit source code, not APKs. Also, the check probably won't last for long anyway, people do releases all the time.

The main thing this would tell you: "Someone looked at the code of this project at some point". And maybe short summary. So this would be something like a review, launched by reputable people (reputable - from the point of view of your Nostr account). Not "the latest APK you are going to install is up to date". Because - you would not check updates anyway. You are deciding to install an app, and when you do, you are just autoupdating anyway. Or it could tell you red flags after you install.

Very probably when you are updating, no one has launched an agent yet. And it might be smart to get updates as they come (they might fix security bugs), not wait for reviewers (that may never come!).

Ideas? Comments?