Somewhere Orbot needs to be installed, and don't APK signatures need to be verified?