So then you trust the app enough that it provides the function you need from it? Trust doesn’t have to be an all or nothing ordeal.

No one said blindly. But why would you use the app if you don’t have trust.

Whatever the app developer recommends. Obtainium directly from the developer repo or F-Droid when they officially support it. Depends if you want the latest version sooner, then the former.

You can turn off auto-update from both.

If you are questioning if the developer is malicious, why are you using their app?

Obtainium is more so if you don’t want any middle man and know the app you are downloading. If you want more checks, I suppose F-droid will provide some.

How does Jami handle offline messages? From understanding its p2p, so both ppl have to be online right?