I'm guessing we can still use the existing obtainium set up with github to get updates until further notice.

There isn't a spec for releases over nostr but imagine having the release you are installing signed by the developers via nostr? That would be an upgrade from the current obtainium trust model, wouldn't it? 

 Yep, especially for first-time installers. After that, the app checks if the key matches the previous version.  

 We've been thinking along the same lines.