I understand and empathize with F-Droid’s position in this. An account and key handover took place. It would be a dangerous precedent for F-Droid to unilaterally take the app down without any proof of anything nefarious based on something as nebulous as community rumblings, with no way to verify any of the ill motives ascribed to the actions of the original and new maintainer.

There’s a lot unclear, but it seems that an actual compromised update was released on official infrastructure (and subsequently removed from some devices by Play Protect). A transparency statement from the developer is still forthcoming. I’m not risking anything, not even updating to the new app, until all the dust has settled.

Definitely something the good guys would do.