But it would be cool to also include apps where their devs don't know/care about nostr.

I was thinking of something like the Arch User Repository (AUR) where users submit packages that are not theirs and it's up to other users whether they trust it or not.