MichaelJohn
I think you are over-estimating a step and there are some misunderstanding...
Johnnyloans is saying that going into github through a browser downloading the apk yourself and doing it through obtainium is the very same thing.
Obtainium just automates this process and makes it convenient to update the app from the very same source.
If you manually go on github, and download an apk, you have no guarantee that the code packed in the app is the very same you can read in the codebase.
This thing doesn't change if you obtain the apk through your browser or through obtainium.
Second step, if the github account and/or signing keys are compromised or the mantainer accepted malware code through a pull request, or the owner goes rogue, downloading the app manually from the browser is the very same than downloading it automatically from obtainium. You still get the same malicious code.
And lastly, AppVerifier is an optional step you can take with and also without obtainium.
You are free to install AppVerifier and verify apps downloaded with your browser.
These are the points @Johnnyloans is trying to make, I guess.
MichaelJohn that process is still more secure than what F-droid does
Excuse me if I make assumptions, but honestly I think you didn't read what F-Droid does, or how.
The security concern F-Droid introduced is signing evey app they compile with their own keys, invalidating Android Security Model.
If I have to be short and naively describe the process, Android "pin the signing keys" of the apps, and allows updates only from apks signed with the same signing keys.
If all the apps have the same signing keys, now you have flattened this feature, introducing a single point of failure.
If F-Droid misplaces the keys, it will become mayhem very quickly, and according to stories from the past, F-Droid is not always trustable with their security choices.
Just to make it clear: Google also signs every app with Google's signing keys.
F-Droid is not Google, tho...
On top of this, F-Droid supports Reproducible Builds, which effectively solve this keys issue.
Every RB keeps the original signature from their developers, making it no different from downloading it from github (and thus obtainium).
So yea...
Maybe if we take the time to appreciate good things and avoiding just the bad parts, we might increase our security stance without giving up convenience.