compile yourself.

or download from a source you trust and compare hash from another trustworthy source. just like anything you download. unless you run gentoo, but then how do you trust your sources, etc

and if you have a closed source phone os that only allows to install from their store... well you have to learn to crawl before you walk.