You are given a similar choice though. Write an app which can do whatever verification you want, gpg or anything, and only give that app permission to install from unknown sources.