I was wondering do they have any way to verify the integrity of the packages they downloaded? AFAIK there is no consistent way for developers to provide hashes/signature of their releases.
To me it seems like grapheneos community have a tendency to be unnecessarily harsh about security on other projects. And in this case, side of burrito's suggestion to download app from github directly instead of fdroid, really is a suggestion that is hard for me to understand...
It is obviously true that fdroid's security model is bit behind, especially with index-v1, but they do provide basic functionality like verifying developer signature and hash of the package downloaded. However, I seriously doubt this app is doing that with github releases, since I am simply not sure how verifying the signature/hash of a release when there is no way to provide such information systematically on GitHub.
It is obviously a great app if you use it for its convenience, but I personally wouldn't use it to enhance security. Or maybe I am just ignorant on the matter, I would highly appreciate anyone o point out any mistake I made.