What Makes You Trust an APK Download?

If you install Android apps outside Google Play, what makes you trust an APK?

There are quite a few things I personally think matter:

Who published the app?
Is the developer clearly identified?
Where did the APK come from?
Does the package name match the expected app?
Is the APK signed by the developer?
When was it released?
What permissions does it request?
Is the source code available?
Can you verify the file's integrity?

I'm working on Aeroapk, so I'm thinking a lot about how Android app discovery and APK distribution can be made more transparent.

But before deciding what information developers should provide, I'd rather hear from developers and Android users.

What's the first thing you check before installing an APK from outside Google Play?

And if you're an Android developer:

What information would you want an APK platform to display about your app?

I'm interested in hearing real experiences — especially from indie and open-source developers.