please point to right direction on how to verify apps? obtainium fails often due to specific configs required [using Graphene OS]

[nervousball]

hi all,
been planning on posting this for some time as i feel seriously stuck

i've been using aurora store + f droid to update my apps. i heard that f droid isnt safe (not sure of exact reasons) + that aurora does not verify signatures and that i should use obtainium instead

app stores that i currently have:

app store - stock one
accrescent (thinking of ditching it as there arent many apps that are relevant to my needs)
f droid (until i figure out way via obtainium)
aurora store (only using it until i figure a way to go through obtainium, also, some apps asking to be updated for me to use them, e.g. banking apps)

now - im struggling on 2 things:

verifying apps via obtainium - im using appverifier when adding new .apk files via obtainium and sometimes signatures couldnt be verified. what do i do then? go to github for official app's page and search for source code there? if so, what do i do if i cant find one there? as seems github the only way for me to get official and trusted .apk files and release notes?

cant update some apps via obtainium - such as tutanota or standardnotes by default settings as it seems they need custom setup, such as ticking "include pre releases" option and adding text in field "filter apks by regular expression"

now to do this you only have to set things up once per app, i understand, but im just a regular graphene os user and i think it is frustrating to have some apps set up on obtainium via custom configs - especially if you cant get information online for specific struggle and this is huge demotivator for me spending time figuring out how to update every specific app that im get errors with..

the best that i've found was a list of .apks that i could automatically download off github, from official obtainium github devs?
https://apps.obtainium.imranr.dev/

and of course some apps arent there OR arent properly explained how to set it up so updates could be successfully downloaded, so i guess i need to either find a way on how to:

configure specific apps so i can get them verified as well as updated...
anyone can help here please?

OR

shall i just ditch this method and create random google account that i will be using only for downloading apps off play store?
if so, what about FOSS apps that i cant find them in play store? use f droid instead?

if you could kindly help me here i would be really happy as now im quite frustrated over downloading apps via aurora due to safety reasons neither i can get some apps to update / verify via obtainium...

thank you