charly Right now, the apps that I have installed directly through their GitHub apks that GPlay is tracking are all Proton apps and AnkiDroid. So I'm guessing that these apks that I downladed directly from their respectives GitHub pages are signed by Google. Should I uninstall them and install them again from GPlay or it doesn't matter if I installed them via apks and now I update them through GPlay?
I would have uninstalled and reinstalled them in that case, just to be certain Google Play actually can update those apps. That is, be certain the installed version actually are signed such that Google Play can update them.
charly However, there are other apps in my Obtainium environment that are in GPlay store but GPlay is not tracking them, so I assume that these apks were signed without Google being involved right?
Most likely, yes. I think those apps aren't tracked because they have a different package ID.
charly So, if I don't want to use F-Droid, I have two choises: one, what I did (even when they didn't state that was an option, but it is), and two, GPlay. If I assume that in this case the apk has nothing Googled, but the GPlay has... But again, it's not even sure that's the case.
I wouldn't know either. In the end, you would have to pick who makes more sense to trust in your specific threat model.
charly Basically, if even if I am very careful, in one profile I have 10 fully FOSS apps and there is one that is FOSS but signed by Google or directly installed from GPlay, is there really any privacy implications?
I don't know your threat model. What is it you worry about Google might do through their proprietary blobs, that mustn't happen?
For me, that worry would be spying on my end-to-end encrypted chat conversations, through pretenses like "scanning for unsafe content" or the like. Or accessing local files through apps I have granted such permissions to, under similar pretenses. So in my case F-Droid makes sense, to ensure there is only open source code in the app, as open source code tend to be resistant to getting such privacy invasive technologies added.
But you might worry about something totally different, where using Google Play or Obtainium/GitHub releases make far more sense.
Each app is sandboxed, so that one app cannot interact with those other apps or access their data, unless those other apps specifically allow it. Which is unlikely if they don't have the same binary blobs in them. Most likely, the proprietary Google components will do absolutely nothing, unless Google Play Services is also installed in the profile, as that is how communication typically happen.
charly Again, maybe I'm overthinking everything too much and I'm complicating everything and things are simpler.
I think the first you have to ask yourself is, what is it really you worry Google would do, that mustn't happen? Is Google even your enemy at all? Is Google really the greater enemy compared to who you would put your trust in instead?