F-Droid's signature, not the developer's: a reproducible build from source. It differs from the Google Play build — you cannot install one over the other.
File hosted: Apache-2.0 — open source, the APK comes from the official source.
SHA-256 and the certificate are recorded at ingest; a change of signing key stops the card from updating.