The JPOS marketplace distributes signed app bundles to every JPOS desktop. Register a publisher account, register an ed25519 signing key, and start uploading.
com.example.todo.bundle.zip, sign it with your private key, upload it.Bundles travel through Cloudflare R2 and may be cached anywhere. Each version's signature is verified on the user's machine before install — only the publisher who holds the matching private key can release a version under that app id. No middleman, no impersonation.