zap.store does this for you, but you are right that for verifying zap.store itself you need to either trust the domain or verify the hash.

This is why we publish hashes in our nostr profile.

If you already have AppVerifier, that's one way. Or you could do it in the computer. Would be nice to have tutorials for both