Know the file.
Trace the history.

An APK passport is a factual record of one Android package: its identity (package name, signing certificate, SHA-256), the permissions it requests, every documented version and where each file came from. Where a publisher source exists, we compare the file’s SHA-256 with it and the card says whether the hashes match. A passport describes a file — it is not a verdict on how an app behaves.