This is the approach of fdroid which is what imo makes it trustworthy.