The application publisher generates a pair of public and private keys, the private key is kept by itself, and the public key is made public.
When publishing an application, first digest the application, and then encrypt the digest with the private key.
When publishing the application, publish the "encrypted digest" with the application.
When the user verifies the validity of the application.
The user digests the application to get digest 1, and then uses the public key published by the publisher to decrypt the "encrypted digest" to get digest 2. Compare digest 1 with digest 2. If they are the same, you can ensure that the application is indeed the The public key is issued by the publisher and has not been tampered with.