gvprtskvni
I believe the general recommendation is to be cautious about F-Droid builds as they are signed by F-Droid developers, but nobody can really vouch for them being safe except F-Droid, or that they're safer than Google Play builds, which are considered very secure from outside malicious actors.
In other words, your apk is probably 'real' if you get it direct from the developer (if they offer it, and if you're sure their github credentials weren't stolen).
It's also likely real and not a malicious apk if you get the version that Google signs and offers on the Play Store (since the chances of Google being hacked and swapping out an apk with malicious code are pretty minimal). The same would apply to Aurora Store apks since they're just the ones signed by Google.
Closely third in line is if you get a signed version from F-Droid. The online community generally trusts F-Droid but I think that's only based on faith in their sincerity, not any innate security practices - I'm not sure though. However I don't believe there's been an instance yet of F-Droid signing a malicious app, but again, anyone can correct me if I'm wrong. Also F-Droid builds tend to lag behind Play Store builds since the apps have to wait for F-Droid to rebuild and sign them. For instance, Signal recommends you install directly from the Play Store for security rather than offering their own apk or using F-Droid.
Then finally, if you want to continue this thought process, the least secure route is sourcing apks from various websites or Telegram channels. You can still find real apks from those sources, but the chances of you accidentally downloading a malicious apk are higher.
However, I think these security concerns are pretty minimal for the average user who isn't being targeted by a state actor. I use a mix of Play Store, F-Droid, and apks sourced directly from github. However, it pays to know a little about how you get your apps, especially if you're venturing away from the Play Store.
Off topic maybe, but I will say that I think a risk with Obtainium is that users tend to search github/etc and then pick the first result, without really verifying the app. What I'm thinking of is someone could fork an app, make it malicious, offer it on Github under the same name, and Obtainium users may install it.