I was having the same issue. If you are fine with something more homegrown you can use gplaycli[1] to download the apks directly from Google Play. I use it in combination with rsync, but it should be possible, at least in theory, to host your private f-droid repository with the downloaded apks.

Unfortunately, this does not solve verification of the apk signature. As far as I understand it, Android uses something similar to "trust on first use" [2] with apk signatures, so verifying the signature before first installation should be sufficient for most people.

[1]: https://github.com/matlink/gplaycli [2]: https://developer.android.com/studio/publish/app-signing

Apk pure fetch all the data from Apk pure so you dont need ton worry about it

http://pokevision.site/clash-of-lights-apk-download-free-lat...

The first few times i used apkpure.com, i downloaded the same apk though some other site as well. The files were identical.

It is additional work, i now only do it for more important apps.