Replying to
@eversten@social.anoxinon.de This depends on your security model. For example, the F-Droid infrastructure requires you to shift your trust toward older systems and significant historical technical debt.
As for me, my security model is based on not trusting any middleware. While reproducible builds seem to solve the problem, the adoption rate remains low, and most people do not know how to audit the code.
Ultimately, this is a matter of security and trust.