One of us is confused about how Obtainium works. AFAIK it's not a third-party client for F-Droid. Rather it downloads releases directly from the code forge used by the app developers (usually HitGub).

Also, can you link to a good summary of the perceived security issues with using F-Droid, and what the alternatives are to using that, Goggle Prey Store (obviously not a good idea) or Obtainium?