I'm playing with my first Android device.
First thing I discovered is that Google Play isn't installed. If I search for an APK for Google Play Store, the results are from third parties such as apkmirror.com rather than from Google itself.
This seems to be the norm. When I discovered how many permissions Google Play wants for itself, I declined and experimented with looking for APK files individually.
Same story, APKs seem to be available through myriad third-party websites, none of which I trust not to repackage an apk with malicious code.
This device is just for experimentation, so I've been installing things anyway just to see what happens. I'm amazed that there seems to be no indication whatsoever that app developers are publishing cryptographic signatures or SHA hashes or offering any sort of authoritative statement that an apk is authentic.
Generally speaking, if I google
apk site:foo.com I get no results, or only a link to get the app through a store.
Why don't developers release the raw APK files or any means to verify the APKs available through third-parties?