Nothing. The innovation here is that you are downloading Bitcoin-core from a Nostr-based app store, and the keys signing for the legitimacy of the app are being vouched for by people within your web of trust.