Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?
You might for example have an open source application with developers located in multiple jurisdictions who cooperate by publishing the SHA for every version distributed by the App Store operators.
Is anyone doing this for any ssh clients, off-the-record messaging, etc. clients distributed through App Stores?
Are there any App Store for which this is known to be impossible, i.e. they often modify the source without revealing the changes to the original author?
There are of course closed source programs like Covert Browser for which no verification is possible except by the authors.