I really like that this is coming up. Verifying software is a painful process and a lot of people don't even know what you're talking about when they get asked. I'm barely able too. Even found the process annoying trying to check APKs with appverifier because the apk hash isn't always available... I've been trying to figure out how the NixOS (nixpkgs) works because I want to try helping with maintaining some software packages... and I wanted to know if the software I used was checking the devs signing correctly. At this point I just feel more confused than informed.