Equal2024 Isn't Termux much more than an SSH client?
Don't know. I don't use it. I just know its a terminal emulator like JuiceSSH.
they sign their APK files with a test key that's publicly available.
And as stated on their github, it can't be used to impersonate them. As long as you're installing updates only from the official repo, there shouldn't be an issue. Besides, the test key is just for the github APKs anyway. If you're concerned still, you can install from Fdroid (you can use Obtainium to install from Fdroid if you wish to avoid their app) or Google Play as per their instructions.