Speaking as a KDE Connect user who's heard of F-Droid, I installed F-Droid, then deinstalled it. It was too noisy and intrusive. When I told it I didn't want to replace an app with its version it kept asking again and again, every day at least.
Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature. That's as bad as the TLS inteceptors that insist on accepting an extra CA.
Some people seem to think that F-Droid is obviously preferable to Googleplay. That is, at the very least, not obvious.
Fdroid maintainers require shipped apk's to have 0 non-free components. The only way to ensure that is to build the apps themselves (so that they can verify code and control dependencies). This means that they can only use their own keys.
No it doesn't. They could check the developer's signature against an APK built from source. It's not that difficult.
BTW. In my case the app they urged me to replace the stock keyboard with a version that had been built without support for Norwegian. Is the language data in Android non-free?
They can, and they offer that, if the developer supports reproducible builds.
Most apps aren’t possible to be built reproducibly, though, as the Android developer toolkit was never designed for reproducible builds and relies on stuff like filesystem ordering of files (which differs between machines).
> Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature.
They do reproducible builds starting from publicly available source. Given the AOSP design where code signatures are mandatory and updates are only allowed if signed by the same key, they're taking the best feasible approach.
Care to elaborate? You're trusting the developer to write the source code and do all the debug builds, what's the problem with building the production build?
Assuming you trust F-Droid, it eliminates the possibility that the developer isn't using their published source code. eg. they might hide their tracking code from their public github repo but build it into their release apk.
> installing and managing apps through it is also easy
but updates are not automatic (unless you root)
I don't dispute that F-Droid is not terribly difficult to use, but the original statement that "It's easier to use than the Play Store" is obviously false as soon as you take into account the mechanics of getting it installed.
