There already exists a “Google Play licence check” permission apps can use to verify whether or not the app has been bought on a Google account that’s present on the device.
If people can crack the app to remove this (which is a thing for some of the popular apps), they’ll also figure out how to patch this out. This is strictly useful for free apps, and only serves to make it unviable to distribute verifiably clean apk’s outside of Google Play (so rip APKMirror)
Regarding the second link, I’ve personally git pulled Ryujinx about once a week (except this week lol) ever since Yuzu was taken down. I don’t know enough about git to know if commits earlier in the history can be manipulated whilst keeping later commit hashes identical, but I can confirm that the commits from last Tuesday match up with my local copy in terms of hash, author and message