[nefariousoctopi]

I was having the same issue. If you are fine with something more homegrown you can use gplaycli[1] to download the apks directly from Google Play. I use it in combination with rsync, but it should be possible, at least in theory, to host your private f-droid repository with the downloaded apks.

Unfortunately, this does not solve verification of the apk signature. As far as I understand it, Android uses something similar to "trust on first use" [2] with apk signatures, so verifying the signature before first installation should be sufficient for most people.

[1]: https://github.com/matlink/gplaycli [2]: https://developer.android.com/studio/publish/app-signing