Which Google Play does not, happily serving you all the "known trackers". F-Droid is strictly superior on this front.
> You still have to trust the app developer
I don't have to trust the developer as much because I don't have to take their word for it that the compiled app matches the public source.
> and you'd be much better off trusting the strong guarantees provided by the Android app sandbox anyway
False dichotomy. I still have the sandbox with F-Droid. This is chaff.
> Play App Signing is mentioned in the article.
...Okay? What a non-sequitur. Signing is completely off-topic to the fact that Play Services is spyware (notwithstanding your assertion that it isn't). Unlike F-Droid. That's a huge difference.
It's like saying "when meeting a sketchy stranger, don't bring a friend along or meet in a public place because now you have to trust the friend as well, and also the friend might not be strong enough to overpower the stranger anyway. Safer to take an Uber to their house and lock the door behind you."