Mullvad has a guide on verifying signatures. Before now, the Mullvad VPN desktop app was only hosted by Mullvad on servers in Sweden, with GitHub as a backup.

Google Play, Android's official app store, is now tagging VPN apps with an 'independent security reviews' badge if they conducted an independent security audit of their software and platform.