So you linked to apt.
I guess good for anyone who finds this interesting…
But more on topic here is is a link to answer from 2020 from an flatpak maintainer:

If a user installs or updates a specific app-id the code verifies that:

• The new app is gpg signed by a trusted key
• Checksum verifying that all files are untampered with
• The new app has that app id
• The new app has a later timestamp on update