publish hashes of android apk signing keys

[grrrrr]

On Android, you can use AppVerifier to confirm if an apk was signed by the owners or an untrusted key (as well as other methods). This can be combined with Obtanium to check at install time.

The hashes could be published in a number of places for additional trust. e.g

• blog post
• gpg signed download
• mastodon / twitter /...
• Github