[deleted] The most important thing is that the SHA-256 certificate hashes of the APKs you have installed match their expected hashes. No matter what source you install from, if the certificate hashes match, your installation is genuine.
To check this you need AppVerifier as you said, however you can't just trust AppVerifier by installing it from Github and being done with it. You need to verify that AppVerifier is authentic first in order to be able to trust the hashes that AppVerifier shows you. You have two options if you are not on GrapheneOS:
Install AppVerifier from Github and follow the information in the Readme:
Install Accrescent from Github and manually verify it using the steps in the FAQ. If the hashes match, any app you install from Accrescent (in your case, AppVerifier) is confirmed to be authentic now.
Now you can use AppVerifier to check the certificate hashes of your installed APKs. Not all apps are available in the AppVerifier internal database though so if you want to compare certificate hashes with others, there is a thread here.
For everyone else reading, if you are on GrapheneOS all you need to do is simply install Accrescent from the GrapheneOS App Store (This confirms Accrescent is authentic) then install AppVerifier from there. No other steps are needed and you can start verifying SHA-256 certificate hashes as you please.
Please note that there is no need to verify certificate hashes of apps you install from Accrescent once you have verified that Accrescent is genuine. Same applies for apps installed from the Play Store using Sandboxed Google Play on GrapheneOS. You will always need to verify certificate hashes of APKs you installed from sources such as Aurora Store, or the internet.