The update API returns a signed manifest containing version, URL and SHA-256. The app must verify the Ed25519 signature before trusting manifest data.
Step by step
Verify the manifest signature with the embedded Ed25519 public key.
Download only from the URL in the verified manifest.
Compare the downloaded file SHA-256 with the manifest.
Continue installation only after the hash matches.