This is a (mostly) solved problem in linux. Your package manager has a central repo, but also can have 3rd party repos added. You'd add the matrix repo and it would automatically update it with everything else. It means everything still gets updated and verified against the keyring.

Android's has an app signing system which isn't dependent on Google Play. Updates to a given app have to be signed with the same certificate as previous versions.

Signal, for instance, does this: https://signal.org/android/apk/

You can use fdroid which builds everything and signs it with their own keys.

Where do you get the certificate from? If you get the APK and certificate from the same source, there's no security benefit of verifying the certificate on top of having a proper TLS connection.

If you update the application, Android will check that the certificate of the current version matches the one from the update before allowing you to install it.