On the safety point, how would I ensure that e.g. the APK for my banking app is authentic and unmodified?
Maybe we should ask all banks to publish their apps via F-Droid build service so the build hashes on both the Play Store and its mirrors can be checked for third-party modification.
Expecting my bank to listen to suggestions about publishing hashes for F-Droid users is not realistic, so assuming that they would never do this, how would I verify the app outside of the Play Store?