On a computer, run shasum -a 256 <the file you downloaded>. It should print:
b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137
If you have zsp, Zapstore’s publishing tool, zsp utils extract-apk <the file you downloaded> works too. Its hash should be the same SHA-256:
b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137
On the phone, AppVerifier should show this signing certificate:
99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320