Apps are downloaded from the publishers. We validate files with SHA-1 hashes and digital signatures (where available) before using them.