Like SSL, Apple and Google need to do their part to provide a way for developers to validate an app and prevent clones from being installed instead even if coming from a 3rd party store.
And SSL validates just the domain name, which still allows all the phishing attacks to thrive. Compare installing App for the first time to coming to some website for the first time ever. SSL doesn't really provide anything to identify the site, anyone can get any domain.