That's exactly the same approach employed by Gitlab and is actively being deployed and used by GNOME and F-Droid.

Could you elaborate why this approach is confusing?