Ah I figured as much. Yeah with the open source thing I was supposing there was a way to verify via some signature that the code version on the play store matched what was in the repository, but probably even getting such a system like that working properly and securely is non trivial, and even keeping tabs on versions becomes burdensome even if possible, so in the end it'll ride much on developer trust, as you say. I already trust steem connect in this way ha....

Thank you for the response! In any case I am not using the owner key and should be using my account in a way that if the active key does get exposed it impact is not as high.