In a round about way you sort of can now. The “allow installation from unknown sources” is per app-source now. You need to enable it for Google Chrome if you downloaded the package from Chrome, or for F-Droid if you downloaded it from F-Droid. So, the solution you’re looking for could be just a small shim app to download from your own repository of sorts. Janky .. but it’s a bit more possible than before I guess. As an added bonus you could do some signature validations too!

If you use F-Droid, you could also just set up your own local repository for your custom apps.

Yup! I was just running under the assumption the parent comment wanted no other apps period, with a smaller surface to attack.

I'm an iOS user, but I suspect I'll end up switching back to Android for my next phone in 4/5 years.

Is there a way around this where you can say "no, just let me install from anywhere" or is it forced unless you root the device?

The reality is it only takes 2-3 seconds to allow it, it’s a direct link to the relevant setting. Once you allow it for that app (say, Chrome or Google Drive) you don’t have to do it again unless, of course, you disable it.

Yeah Android 8 introduced it. It's a good change IMO.

There's nothing bad about "allowing installation from unknown sources" if you know your sources. It's just a scare tactic Google uses to quash competition.

An app you compile yourself (assuming you at least tried to read the source code, the open source Google Auth is pretty brief/readable, I've reviewed it before) is vastly more secure than installing whatever the Play Store serves you.

This is frankly a ridiculous statement. If you are an experienced software developer, and correctly apply supply chain security policies, you can likely build and install an apk correctly.

Literally billions of regular users cannot do that, and regularly install malware laden apks.

Consider that if I know how to get to my bank's website, and it gives me an APK to install, I know it came from my bank, unless my bank's server is compromised in some way.

I have no way to easily determine that an app on the Play Store actually came from my bank. At best, I can look at the install count, hope the app store does a half way decent job looking for fraud, and hope for the best. Maybe if I'm lucky they have some sort of verification program?

The idea we actually trust app stores from Google or Apple over a direct install from the institutions we want to interact with is hilarious, especially considering all of the rampant malware and fraud issues on the Play Store.

You go to the bank's website and it has a link to the app on the store?

If they dist an apk, how is the bank to provide updates for their app? Build their own updater architecture? If there was a mitmed update from a store they could cancel it centrally.

Telling people to prefer apks is setting them up to be hacked.

The hybrid approach gives you both benefits. Go to the website of the known institution, and follow their links directly to the downloads in the app store.

You are given a similar choice though. Write an app which can do whatever verification you want, gpg or anything, and only give that app permission to install from unknown sources.