Personally, it seems like it's trustworthy again. The previous owner of the repo did eventually admit that they authorized the transfer, but, The entire transfer process was extremely sketchy and had no chain of custody or trust. It was just the repository got deleted, and then a few days later showed under a whole blank state again with a user with no profile, no contribution history, and it was just a trust me bro, I knew the original maintainer look I have the keys to prove it.

The maintainer of the Google Play build of it seems to trust them though, and they are established in the community, plus they archived their sync thing builds again in favor of just using one repo, so it's likely fine.

For future people wondering about it as well, it doesn't help that the new maintainer of the app has deleted every issue that had to do with the migration, so you no longer can research the issue for yourself. The only information you have available to you is the discussion chain listed on the community forums, But any type of issue that they link to were deleted.

Personally though, I plan on keeping my current version pinned to prior to the transfer until either I'm forced to update due to bugs or I feel comfortable with the current maintainer again. I'm not sure how long that will be.

For an app that contains very sensitive information, I was not impressed with how the transfer process underwent.