schweizer In the EU there are three approaches for Apple devices, with the third one being "federated app stores"? And actually it's possible, some of the time for some apps, for end users to build them from source, so perhaps arguably a fourth option?
schweizer The two approaches are incompatible.
On a single Android device it is completely possible to have apps obtained via a mixture of the approaches.
schweizer I wanted to point out this discussion is not solved.
I suspect the author of AppVerifier was indicating that the problem the author designed AppVerifier to solve has been solved. In particular, there is a chain of trust from a GrapheneOS installation, through the App Store app and the Accrescent app, to an app that runs on devices and can be used to read and compare app author signatures.
schweizer The majority of appdevelopers are not willing to provide apks and payment processes. And Google as the central intermediary is not willing to provide privacy.
It's indeed a problem, and various people are trying various things. The EU has their ideas; the Accrescent author has an idea; from time to time lobbying the developer of some specific app has results.
Meanwhile, the laws in many jurisdictions place limits on privacy when money changes hands.