[pooper]

> unpaid third party volunteers

I struggle with this question as well but a small nit here is the folks at Fedora or Debian are not third party. They are a trusted source for me.

I don't know what would be a good solution. Being available on flathub is a good start but I'd argue it is not enough. I'm going to say the proper solution is the same that I advocate Google Play and Apple App Store to follow:

1. require developers to submit source code and machine readable build instructions

2. the store should build the application (fat binaries, differential small updates, whatever, the app store is in charge)

3. ...

4. Profit?

[wmf]

3. The store does little or no testing so users would have been better off with official binaries