I mean surely that's solvable in a similar way that it was for websites, ie SSL+certs registered to domain x. Can the OS (Android, iOS) not have a provision to show who any app is really from in the same way that I can see right now that: "Y Combinator Management, LLC. issued by Digicert"?

Unfortunately it's not really perfect solution for the web either as plenty of people still get scammed by fake urls + not bothering to check who the cert is for/from...