the open source community should ask for their own install key and that's it

Play store can be fast and verification based and the F/OSS stores can be slower, reputation and review based.

...

But fundamentally the easiest thing is to ask people to pay to unlock the phone's security barriers, this makes it harder and costlier for scammers.