The signature and the random updates issues can be solved (partially) by using the izzyondroid repo. A lot of the applications on fdroid are on it. It compiles from sources, doesn't change signatures, and fetch updates on a daily basis.

It doesn't solve all the issues, but it can help

"Oh no, an issue that will only affect an extremely narrow spread of people who would already be aware of it, therefore F-Droid bad"

If you're that concerned about being surveilled, you already have bigger issues.