is there a web-of-trust setup / app here on nostr? imagine could harvest signatures on apk files like this in place of having to defer to play store etc.