Why do APKs never seem to be available directly from the developers, but only through third-parties? I'm playing with my first Android device.

First thing I discovered is that Google Play isn't installed. If I search for an APK for Google Play Store, the results are from third parties such as apkmirror.com rather than from Google itself.

This seems to be the norm. When I discovered how many permissions Google Play wants for itself, I declined and experimented with looking for APK files individually.

Same story, APKs seem to be available through myriad third-party websites, none of which I trust not to repackage an apk with malicious code.

This device is just for experimentation, so I've been installing things anyway just to see what happens. I'm amazed that there seems to be no indication whatsoever that app developers are publishing cryptographic signatures or SHA hashes or offering any sort of authoritative statement that an apk is authentic.

Generally speaking, if I google apk site:foo.com I get no results, or only a link to get the app through a store.

Why don't developers release the raw APK files or any means to verify the APKs available through third-parties?
If you'd install apps from the developers website directly, you had to trust each of the developers personally that their apps do not contain any malware etc. That's why there are "app markets" (see our alternative-markets tag-wiki for details). Choosing wisely, the user then just needs to trust that market to do the necessary checks. Most of them have such checks in place:


Google Play Store has e.g. its "bouncer"
F-Droid compiles the apps from the resp. sources, which it checks beforehand
Aptoide uses several sources to validate packages (e.g. VirusTotal, comparing signatures, and more).


Besides (and the last item implicitly mentions this), developers provide means to check the validity of their .apk files: they sign them with their certificates. Only the dev has the "private key", and validity can be checked using the "public key" – or simply the key's finger-print. Which is what e.g. Aptoide includes in its "malware check": It compares if the finger-print matches with what .apk files of the same dev from other sources (mainly Google Play Store) shows.

As your device doesn't ship with Playstore (and I fully agree its permission hunger is excessive), I would recommend you using F-Droid. Their repository isn't nearly as big as Googles, but the security measures are good. And you can use additional repositories with their app to cover a larger pool. I definitely and strongly discourage using .apk files you found "somewhere in the wild" unless you know exactly what you do (i.e. either you can trust the source, or know how to check the .apk for yourself to establish trust).